Viewing profile — webhamster

German implementer here. We have to use some kind of attestation mechanism per the eIDAS implementing acts. That doesn't work without operating system support. The initial limitati…

For starters, without restrictions on the redirect URI, I (as the attacker) can just redirect a user to the authorization endpoint with a client ID of a trustworthy client, a redir…

That's not correct. There are a number of attacks that can be mitigated by both, but PKCE serves as a very effective defense in case an authorization code leaks to an attacker. Suc…

Can we finally stop conflating an encoding/signature/encryption method with a transport/storage mechanism?!

Quote: The resource owner password credentials grant MUST NOT be used. This grant type insecurely exposes the credentials of the resource owner to the client. Even if the client is…

FYI, the IETF plans to deprecate the Resource Owner Password Credentials Grant you are talking about [1]. [1] https://tools.ietf.org/html/draft-ietf-oauth-security-topics

There is no issuer in OAuth. Therefore, the distinct-redirect-URI solution is the most universal.

Also, we now have formal proofs for the security of the OAuth and OIDC protocols.

Does Hydra follow the OAuth Security BCP ( https://tools.ietf.org/html/draft-ietf-oauth-security-topics... )? I do not see PKCE or mix-up mitigation mentioned, for example.