Re: [OAUTH-WG] Second OAuth 2.0 Mix-Up Mitigation Draft

Question: 

I understand how “iss" helps mitigate this attack (client knows response was from the appropriate issuer and not an attack where the request was answered by another issuer). 

However, how does passing “state” on the authorization_code grant token request help once you have the above in place? Is this against some alternate flow of this attack I don’t see, or is it meant to mitigate some entirely separate attack?

If one is attempting to work statelessly (e.g. your “state” parameter is actual state and not just a randomly generated value), a client would have always needed some way to differentiate which issuer the authorization_code grant token request would be sent to.

However, if an AS was treating “code” as a token (for instance, encoding: client, user, consent time and approved scopes), the AS now has to include the client’s state as well. This would effectively double (likely more with encoding) the state sent in the authorization response back to the client redirect URL, adding more pressure against maximum URL sizes.

-DW

> On Jan 20, 2016, at 11:28 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
> 
> John Bradley and I collaborated to create the second OAuth 2.0 Mix-Up Mitigation draft.  Changes were:
> ·       Simplified by no longer specifying the signed JWT method for returning the mitigation information.
> ·       Simplified by no longer depending upon publication of a discovery metadata document.
> ·       Added the “state” token request parameter.
> ·       Added examples.
> ·       Added John Bradley as an editor.
>  
> The specification is available at:
> ·       http://tools.ietf.org/html/draft-jones-oauth-mix-up-mitigation-01 <http://tools.ietf.org/html/draft-jones-oauth-mix-up-mitigation-01>
>  
> An HTML-formatted version is also available at:
> ·       http://self-issued.info/docs/draft-jones-oauth-mix-up-mitigation-01.html <http://self-issued.info/docs/draft-jones-oauth-mix-up-mitigation-01.html>
>  
>                                                           -- Mike
>  
> P.S.  This note was also posted at http://self-issued.info/?p=1526 <http://self-issued.info/?p=1526> and as @selfissued <https://twitter.com/selfissued>.
>  
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org <mailto:OAuth@ietf.org>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>