Some good points. Other links of interest: http://tools.ietf.org/html/rfc6819 and OWASP cheat sheets, including ones on authentication in general: https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series amongst other resources on Google ;-)
OAuth Security Cheatsheet
11–16 of 16 posts
Re: OAuth Security Cheatsheet
#12You missed the obvious: using OAuth2 without TLS =)
And paranoid part of my brain suggests that using OAuth1.0a is still preferred even if over TLS
Re: OAuth Security Cheatsheet
#13You missed the obvious: using OAuth2 without TLS =) And paranoid part of my brain suggests that using OAuth1.0a is still preferred even if over TLS
This is another kind of threat but yes, MITM is game over for oauth2
Re: OAuth Security Cheatsheet
#14The place I work for deals with about 20 different site's oauth processes and it's amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don't, some of them still need you to send a login/password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them require that the token be passed as a query strin…
i've heard great stuff about oauth.io . they try to provide an abstractionlayer that handles the various different implementations (often buggy or not to spec) of oauth.
Re: OAuth Security Cheatsheet
#15The place I work for deals with about 20 different site's oauth processes and it's amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don't, some of them still need you to send a login/password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them require that the token be passed as a query strin…
i've heard great stuff about oauth.io . they try to provide an abstractionlayer that handles the various different implementations (often buggy or not to spec) of oauth.
that might be true, but I don't like idea of having a MiTM. That's an additional point of potential security issues
Re: OAuth Security Cheatsheet
#16Earlier quoted context omitted.
i've heard great stuff about oauth.io . they try to provide an abstractionlayer that handles the various different implementations (often buggy or not to spec) of oauth.
that might be true, but I don't like idea of having a MiTM. That's an additional point of potential security issues
i think its fully open source[1] and you can host on your own