Serious hard-to-fix bug in OAuth and OpenID discovered, lots of major sites affected

2 Comments

• 

  slbmeh

  May 9, 2014 6:43 am

  I wouldn’t quite consider it a security issue or a bug. The standards OAuth puts in place performs a request based on a signature prepared by the application generating the URL. Any access being granted is to the application initially signing the request.

  It is indeed a phishing risk, and potentially a design flaw in the spec of the oauth standard. But it’s a simple fix. Add the redirect url to the hmac signature and if the request uri doesn’t match the redirect parameter then bail with a message notifying the user that the signature could not be verified.

  Reply
  • 

    Chris

    May 9, 2014 11:47 am

    Thanks, good info in here! Btw I’ve written this before reading into the topic. Most good sources also say it’s not a bug, it’s simply bad implementation of the according companies / developers.

    Reply