Re: [OAUTH-WG] Report an authentication issue

If an attacked can modify the communications over TLS between the client and the authorization server, then I think there are many other options open to the attacker.

-- Dick

On Jun 29, 2012, at 11:53 AM, Phil Hunt wrote:

> I'm not seeing how client id helps if a proxy server is somehow involved with inserting the bearer token as the researchers suggested. 
> 
> Phil
> 
> On 2012-06-29, at 11:30, John Bradley <ve7jtb@ve7jtb.com> wrote:
> 
>> I think they only exploited the implicit flow.   
>> 
>> My point was that there is a way you could do the same thing with code if it is a public client that is not authenticating to the token endpoint.
>> 
>> In general making identity assumptions in the client based on a code or access_token has risks that are out of scope for OAuth.
>> 
>> We do however want to provide good advice about specific things that can leave systems insecure when using OAuth.
>> 
>> John B.
>> 
>> On 2012-06-29, at 2:22 PM, Phil Hunt wrote:
>> 
>>> I'm not clear whether the MS Security Researcher hack was with the authorization code or the access token. If the latter, the client_id is out of the picture isn't it?
>>> 
>>> Phil
>>> 
>>> @independentid
>>> www.independentid.com
>>> phil.hunt@oracle.com
>>> 
>>> 
>>> 
>>> 
>>> 
>>> On 2012-06-29, at 11:14 AM, Dick Hardt wrote:
>>> 
>>>> 
>>>> On Jun 29, 2012, at 11:06 AM, John Bradley wrote:
>>>> 
>>>>> It is nice to know that I may occasionally be correct:)
>>>> 
>>>> You must be delighted when it happens! ;)
>>>> 
>>>>> While you may assume that it is reasonable for a client with a code to make a request to the token endpoint including it's client_id and the server to only give out the access token if the client_id in the token request matches the one in the original authorization request.   However the spec specifically doesn't require that.
>>>> 
>>>> I think that is an error in the spec and should be changed, or text adding saying that the client_id SHOULD be checked.
>>>> 
>>>> -- Dick
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>> 
>> 