OAuth Security Cheatsheet
oauthsecurity.com
OAuth Security Cheatsheet
1–10 of 16 posts
Re: OAuth Security Cheatsheet
#2It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
Re: OAuth Security Cheatsheet
#3Thanks for this list. I will be reviewing our site at whalepath.com to make sure we are not vulnerable.
btw, linkedin has implemented a number of the counter measures listed in:
* static redirects
* checking that the redirect listed is the same for all calls.
* fast expiration of code.
Re: OAuth Security Cheatsheet
#4It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
@homakov I'd be happy to host this content on the oauth.net website if you'd like.
Re: OAuth Security Cheatsheet
#5It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
@homakov I'd be happy to host this content on the oauth.net website if you'd like.
I think just an external link will be great, because I don't want to remove the sakurity logo :)
Re: OAuth Security Cheatsheet
#6It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
Why didn't you use github page or S3. It's static page isn't it?
Re: OAuth Security Cheatsheet
#7It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
off-topic: I see you made a commit two hours ago but when I try to click on the commiter the link is not enabled, try this guide to set your name and github username so all your commits are linked to your github user account: https://help.github.com/articles/setting-your-username-in-gi...
Re: OAuth Security Cheatsheet
#8The place I work for deals with about 20 different site's oauth processes and it's amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don't, some of them still need you to send a login/password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them require that the token be passed as a query string parameter instead of as a header for all requests. Being responsibly secure with all of them is quite difficult. It doesn't help that it's very difficult to have a development environment work properly with them, so doing active work against them is often painful.
OAuth is basically a complete mess, implementation-wise, and that's really sad since it's such a promising and useful premise.
Re: OAuth Security Cheatsheet
#9The place I work for deals with about 20 different site's oauth processes and it's amazing how widely varied they are. Some of them let you restrict the redirect_uri while others don't, some of them still need you to send a login/password pair for the first request rather than do an oauth flow, but then still use oauth-style tokens all over the place. A couple of them require that the token be passed as a query strin…
That's really unfortunate. I read through the RFC, and IIRC it is pretty consistent on those details. Can't stop people from badly implementing a spec :(