[GNAP] Sessions and Post Interaction Completion

Dave Tonge <dave.tonge@moneyhub.com> Mon, 21 December 2020 11:06 UTC

MIME-Version: 1.0
From: Dave Tonge <dave.tonge@moneyhub.com>
Date: Mon, 21 Dec 2020 12:06:26 +0100
Message-ID: <CAP-T6TT95K4Vy=qP510Sk4+yubHU8Qa0otkeZeULCLm_4BRJbA@mail.gmail.com>
To: GNAP Mailing List <txauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000ad3b6805b6f7734e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/txauth/1vpvZWVoTfgcevRpwz12EhmA-ws>
Subject: [GNAP] Sessions and Post Interaction Completion
Precedence: list

Hi

I may have missed something - but I'm trying to follow the params involved
in the "Post-Interaction Completion" section.

As I understand the flow is:
1. RC indicates it can accept "callback" and provides a nonce and a uri
2. AS indicates the callback will be used and provides a nonce
...interaction happens...
3. AS either redirects the user or does a POST to the RC uri with a new
param: `interact_ref` and a hash of the RC nonce, AS nonce and interact_ref.
4. RC validates hash and calls AS with `interact_ref` (and access token)

If the uri provided by the RC isn't unique then I think the RC nonce should
be included in the params. The hash will still be secure as the AS nonce
will not be revealed, but this allows the RC to take actions on the request
before validating the hash.

For example:
1. In some redirect based systems the `state` param in OAuth 2 is used to
redirect the user appropriately (within the RC's systems), prior to being
confirmed by the matching `state` in the session.

2. In the "Direct HTTP Request Callback" mode, I don't understand how the
RC is supposed to know which interaction the callback is for (assuming its
not a dynamic uri)?

Additionally it would be good to see some analysis of why the hash is
needed. My opinion is that where possible validation should occur at the AS
rather than the RC. Do we really need the hash? In OAuth 2 getting access
to the `code` enables a lot of attacks, I don't the same is true for the
`interact_ref`. The `interact_ref` will be bound to the access_token
returned from the initial grant request.

-- 
Dave Tonge

-- 


Moneyhub Enterprise is a trading style of Moneyhub Financial Technology 
Limited which is authorised and regulated by the Financial Conduct 
Authority ("FCA"). Moneyhub Financial Technology is entered on the 
Financial Services Register (FRN 809360) at https://register.fca.org.uk/ 
<https://register.fca.org.uk/>. Moneyhub Financial Technology is registered 
in England & Wales, company registration number 06909772. Moneyhub 
Financial Technology Limited 2020 © Moneyhub Enterprise, Regus Building, 
Temple Quay, 1 Friary, Bristol, BS1 6EA. 

DISCLAIMER: This email 
(including any attachments) is subject to copyright, and the information in 
it is confidential. Use of this email or of any information in it other 
than by the addressee is unauthorised and unlawful. Whilst reasonable 
efforts are made to ensure that any attachments are virus-free, it is the 
recipient's sole responsibility to scan all attachments for viruses. All 
calls and emails to and from this company may be monitored and recorded for 
legitimate purposes relating to this company's business. Any opinions 
expressed in this email (or in any attachments) are those of the author and 
do not necessarily represent the opinions of Moneyhub Financial Technology 
Limited or of any other group company.

[GNAP] Sessions and Post Interaction Completion Dave Tonge