IETF Logo Mail Archive

Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

n-sakimura <n-sakimura@nri.co.jp> Wed, 28 November 2018 20:10 UTC

Return-Path: <n-sakimura@nri.co.jp>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2139C130FDE for <oauth@ietfa.amsl.com>; Wed, 28 Nov 2018 12:10:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.699
X-Spam-Level:
X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nri365.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SAnIJyG5Z08L for <oauth@ietfa.amsl.com>; Wed, 28 Nov 2018 12:10:10 -0800 (PST)
Received: from nrifs02.index.or.jp (nrigw01.index.or.jp [133.250.250.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C5ED130E5D for <oauth@ietf.org>; Wed, 28 Nov 2018 12:10:10 -0800 (PST)
Received: from nrimmfm052.index.or.jp (unknown [172.19.246.144]) by nrifs02.index.or.jp (Postfix) with ESMTP id C5DB0196871; Thu, 29 Nov 2018 05:10:09 +0900 (JST)
Received: from index.or.jp (unknown [172.19.246.151]) by nrimmfm052.index.or.jp (Postfix) with ESMTP id 926884E0046; Thu, 29 Nov 2018 05:10:09 +0900 (JST)
Received: from nriea04.index.or.jp (localhost.localdomain [127.0.0.1]) by pps.mf051 (8.15.0.59/8.15.0.59) with SMTP id wASKA9L0024766; Thu, 29 Nov 2018 05:10:09 +0900
Received: from nrims00a.nri.co.jp ([192.50.135.11]) by nriea04.index.or.jp with ESMTP id wASKA9lr024764; Thu, 29 Nov 2018 05:10:09 +0900
Received: from nrims00a.nri.co.jp (localhost.localdomain [127.0.0.1]) by nrims00a.nri.co.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id wASKA9Ak034000; Thu, 29 Nov 2018 05:10:09 +0900
Received: (from mailnull@localhost) by nrims00a.nri.co.jp (Switch-3.3.4/Switch-3.3.0/Submit) id wASKA9Jo033999; Thu, 29 Nov 2018 05:10:09 +0900
X-Authentication-Warning: nrims00a.nri.co.jp: mailnull set sender to n-sakimura@nri.co.jp using -f
Received: from nrizmf12.index.or.jp ([172.100.25.21]) by nrims00a.nri.co.jp (Switch-3.3.4/Switch-3.3.4) with ESMTP id wASKA8qI033996; Thu, 29 Nov 2018 05:10:09 +0900
Received: from CUEXE02PA.cu.nri.co.jp (192.51.23.32) by CUEXM08PA.cu.nri.co.jp (172.159.253.50) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Thu, 29 Nov 2018 05:10:08 +0900
Received: from JPN01-TY1-obe.outbound.protection.outlook.com (23.103.139.176) by ex.nri.co.jp (192.51.23.33) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Thu, 29 Nov 2018 05:10:08 +0900
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nri365.onmicrosoft.com; s=selector1-cu-nri-co-jp; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1F/MjAqXsOwWFlKPqfI3jt3VRYDGzRjTcYTGWgD+nMg=; b=qqavqbSzCcIITgY9FBSeSd4CStqTOQ61p0hSvR+RfTEkLKiouAuEkU1A3mNGrZbHFoQNu3MAAWfFnCNc0Co9KdKoXHFqgA5FYZUtaEP+txGE6FIxnUvYniDA0BIYTVwcWEnC+pKZTEP3TCKk3rbNknsmL+M4VJKFF2c04V/xduA=
Received: from OSBPR01MB2869.jpnprd01.prod.outlook.com (52.134.253.15) by OSBPR01MB4296.jpnprd01.prod.outlook.com (20.179.180.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1361.15; Wed, 28 Nov 2018 20:10:06 +0000
Received: from OSBPR01MB2869.jpnprd01.prod.outlook.com ([fe80::d1ae:ff36:e681:ce6c]) by OSBPR01MB2869.jpnprd01.prod.outlook.com ([fe80::d1ae:ff36:e681:ce6c%4]) with mapi id 15.20.1294.045; Wed, 28 Nov 2018 20:10:06 +0000
From: n-sakimura <n-sakimura@nri.co.jp>
To: Dick Hardt <dick.hardt@gmail.com>, Hannes Tschofenig <hannes.tschofenig@arm.com>
CC: "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit
Thread-Index: AdR/8wsdlCSgLoNZTem+1MxrAorhbwHYZjwAAABEwfc=
Date: Wed, 28 Nov 2018 20:10:06 +0000
Message-ID: <OSBPR01MB2869E83F37046C7FCD4463DDF9D10@OSBPR01MB2869.jpnprd01.prod.outlook.com>
References: <VI1PR0801MB211266BA6F6E06FFB3081425FAD80@VI1PR0801MB2112.eurprd08.prod.outlook.com>, <CAD9ie-v3onmKc498cg_-a0AD58ZV=aZANtz=UV+Q0f=9N3nSzQ@mail.gmail.com>
In-Reply-To: <CAD9ie-v3onmKc498cg_-a0AD58ZV=aZANtz=UV+Q0f=9N3nSzQ@mail.gmail.com>
Accept-Language: ja-JP, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=n-sakimura@cu.nri.co.jp;
x-originating-ip: [40.67.187.8]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; OSBPR01MB4296; 6:fuBp3S2NCmT6Vv6RMkExbw587tl5YDQu6mTJqxqjRG/fe4QxBcEFHNTU4KzqnVwWEBPqG5++Tb+UF+dOYjQrHd9InmfTHlhy1O/hbO3TxgGrZXSn+O5afv9N61Cr5OiyGEj3RG5MYmG2jZSmtCg7ziUjMLP74hRrXYCIKkz8VHWsBw1E+srxcNuwnIrcIMWC/taPagDrmbl5MwJ/cn4uUODDvWbsjr2l2ORlEl/0nOlHshsUsLkgl2iX6fp5HN+U+TC+NEAk+VemrhMWDDi0qY789Lo4INDivFyUY+pWrJgWOD1ZdsGL8+dKjc92SP1qGT6da/pWO3HePHMm0c1PDnjiUo+eb6MJQC3LaKbhORa4hd4VvDSAmGfaEhs63ig/PK6xGVleJ14G2DtmZZ197556/mF3aTrH4csPANKYGQtdrTm+BH6x8Ba72S+LQVWCnd7us91flvR7wCz6yxPLbw==; 5:OwK2y7Kmg2HfErVNVDERuxvSHeUkesrha4Tx2nd76/zsmNzKmqZCdOjQB4xz71Dls2tF01ScahWwD5t8GUJWzfcTK27qWBSLTiQIy08Hz8hN3W23in1ioFrBcs98mcXcJ8V6Kzg2lh5fzMSZxgKHRiQ0A49AMqtFlTsyz8ZA/X4=; 7:Ej/jwR/cGei/CT1H018UC0iBhlPaYC+tR8B/YKkMu/Rn/7pP46+/qcF75VekpDZtJeaujLA6ytZFSNy4QbdDI+NeMHbqK8ngoHdRXJ2jEoF0g1rWy8r7E7Rb+mHulHRwXx6VchFI9LFEKtU4lO/Ifg==
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 1df5abc8-c4d9-4c74-f54f-08d6556d7da3
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(7021145)(8989299)(5600074)(711020)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7153060)(7193020); SRVR:OSBPR01MB4296;
x-ms-traffictypediagnostic: OSBPR01MB4296:
x-microsoft-antispam-prvs: <OSBPR01MB4296E6D2E25279B47C46EF0AF9D10@OSBPR01MB4296.jpnprd01.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(3002001)(3231443)(999002)(944501410)(52105112)(93006095)(93001095)(148016)(149066)(150057)(6041310)(20161123558120)(20161123560045)(20161123562045)(2016111802025)(20161123564045)(6043046)(201708071742011)(7699051)(76991095); SRVR:OSBPR01MB4296; BCL:0; PCL:0; RULEID:; SRVR:OSBPR01MB4296;
x-forefront-prvs: 0870212862
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(366004)(39840400004)(136003)(396003)(376002)(40434004)(53754006)(199004)(189003)(6246003)(39060400002)(486006)(66066001)(236005)(6306002)(55016002)(9686003)(54896002)(53936002)(74316002)(25786009)(4326008)(446003)(5660300001)(71200400001)(71190400001)(66574009)(476003)(11346002)(256004)(5024004)(14444005)(229853002)(86362001)(74482002)(508600001)(6436002)(7736002)(45080400002)(966005)(606006)(316002)(3846002)(6116002)(102836004)(26005)(186003)(6506007)(53546011)(110136005)(97736004)(2906002)(8936002)(7696005)(68736007)(33656002)(14454004)(76176011)(99286004)(81166006)(15650500001)(81156014)(106356001)(8676002)(105586002); DIR:OUT; SFP:1102; SCL:1; SRVR:OSBPR01MB4296; H:OSBPR01MB2869.jpnprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1;
received-spf: None (protection.outlook.com: cu.nri.co.jp does not designate permitted sender hosts)
x-microsoft-antispam-message-info: kTOcRRBDNcy5eoVGVAGNdL7vBW5qorq0dVO9HncDncQrU6gKKg6f6VY64QFlfcDw4aALrOswP0TBj5ntCwS5M/Ghu0NmF8fvu8pXTcrm1WpHxuJ9y7PJ1tRsLwMV16xrh0fLbqDuUEJyI4PW9SQsHKc1ecYdYl6PoT3YA3IqXsezeLICDNo3Hb1zndboljVSJAUgJf2nbh020+PDvTJLtVmNaM6GXVhdvzqiF76aaD37URZeHDshKqVS4RSN5YY+3+IsU9/qhlaGehr0YueYJV9vuccTm4BEft3h4ONe+iwyWDLAj3mR0GoDhDhati7EReZjwyhEl6nyHJtYAkZf+uPzVGc7U8w19nWcLqkP//8=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_OSBPR01MB2869E83F37046C7FCD4463DDF9D10OSBPR01MB2869jpnp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 1df5abc8-c4d9-4c74-f54f-08d6556d7da3
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Nov 2018 20:10:06.6666 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: e3e360d9-7e7f-48d5-ac33-3c5de61f0a75
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSBPR01MB4296
X-OrganizationHeadersPreserved: OSBPR01MB4296.jpnprd01.prod.outlook.com
X-CrossPremisesHeadersPromoted: CUEXE02PA.cu.nri.co.jp
X-CrossPremisesHeadersFiltered: CUEXE02PA.cu.nri.co.jp
X-OriginatorOrg: cu.nri.co.jp
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/qEiOmYplkvIcdYnRoYe77W7LKdk>
Subject: Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Nov 2018 20:10:13 -0000

I would support

1) clearly defining Implicit as the flow that returns access token from the authorization endpoint ( some people confuses implicit as the flow that returns ID Token in the front channel)

2) Banning the returning of the access token that are not sender constrained from the authorization endpoint

Best,

Nat


Outlook for iOS<https://aka.ms/o0ukef> を入手

________________________________
差出人: OAuth <oauth-bounces@ietf.org> (Dick Hardt <dick.hardt@gmail.com> の代理)
送信日時: 水曜日, 11月 28, 2018 8:58 午後
宛先: Hannes Tschofenig
Cc: oauth@ietf.org
件名: Re: [OAUTH-WG] OAuth Security Topics -- Recommend authorization code instead of implicit

+1

While there are various mechanisms to alleviate some of the issues of implicit, I don't think we can recommend specifics, and there may be future ones in the future. I think we all agree that implicit without any mitigation is problematic.

How about we recommend against using implicit alone?


On Mon, Nov 19, 2018 at 2:34 AM Hannes Tschofenig <Hannes.Tschofenig@arm.com<mailto:Hannes..Tschofenig@arm.com>> wrote:

Hi all,

The authors of the OAuth Security Topics draft came to the conclusion that it is not possible to adequately secure the implicit flow against token injection since potential solutions like token binding or JARM are in an early stage of adoption. For this reason, and since CORS allows browser-based apps to send requests to the token endpoint, Torsten suggested to use the authorization code instead of the implicit grant in call cases in his presentation (see https://datatracker.ietf.org/meeting/103/materials/slides-103-oauth-sessb-draft-ietf-oauth-security-topics-01).

A hum in the room at IETF#103 concluded strong support for his recommendations. We would like to confirm the discussion on the list.

Please provide a response by December 3rd.

Ciao

Hannes & Rifaat

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
OAuth mailing list
OAuth@ietf.org<mailto:OAuth@ietf.org>
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email