If the attacker is able to send the authorization response to an attacker-controlled URI, the attacker will directly get access to the fragment carrying the access token.¶ If the attacker impersonates a public client, the attacker can exchange the code for tokens at the respective token endpoint.¶ If an automatic approval of the authorization is enabled (which is not recommended for public clients according to RFC6749), the attack can be performed even without user interaction.¶

The attacker would also be able to obtain other access tokens held on the compromised system that would potentially be valid to access other resource servers.¶ This kind of late binding is typical in situations where the client uses a service implementing a standardized API (e.g., for email, calendaring, eHealth, or open banking) and where the client is configured by a user or administrator.¶ If the client sends a valid access token to this counterfeit resource server, the attacker in turn may use that token to access other services on behalf of the resource owner.¶ An attacker may set up their own resource server and trick a client into sending access tokens to it that are valid for other resource servers (see Attackers (A1) and (A5) in Section 3).

It works by defining a series of interactions between three distinct parties, namely a client application, a resource owner, and the OAuth service provider. Although OAuth 2.0 is the current standard, some websites still use the legacy version 1a. However, the same mechanism is also used to provide third-party authentication services, allowing users to log in with an account that they have with a different website. The basic OAuth process is widely used to integrate third-party functionality that requires access to certain data from a user’s account. This means users can fine-tune which data they want to share rather than having to hand over full control of their account to a third party.

Note that this implementation is deliberately vulnerable – we’ll teach you how to exploit this later. In these materials, we’ll focus exclusively on vulnerabilities in this SSO-like use case. From an end-user perspective, the result of OAuth authentication is something that broadly resembles SAML-based single sign-on (SSO).

OAuth and XACML

The implicit grant (response type token) and other response types causing the authorization server to issue access tokens in the authorization response are vulnerable to access token leakage and access token replay as described in Sections 4.1, 4.2, 4.3, and 4.6.¶ It is RECOMMENDED for authorization servers to publish the element code_challenge_methods_supported in their Authorization Server Metadata RFC8414 containing the supported PKCE challenge methods (which can be used by the client to detect PKCE support). Authorization servers MUST mitigate PKCE downgrade attacks by ensuring that a token request containing a code_verifier parameter http://www.interact2009.org/?q=node/43 is accepted only if a code_challenge parameter was present in the authorization request; see Section 4.8.2 for details.¶ Otherwise, attackers that can read the authorization request (cf. Attacker (A4) in Section 3) can break the security provided by PKCE. When using PKCE, clients SHOULD use PKCE code challenge methods that do not expose the PKCE verifier in the authorization request. In any case, the PKCE challenge or OpenID Connect nonce MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started.

An attacker might declare an uncompromised authorization server’s authorization endpoint URL as “their” authorization server URL, but declare a token endpoint under their own control.¶ For both defenses, clients MUST store, for each authorization request, the issuer they sent the authorization request to and bind this information to the user agent. As soon as the browser https://www.lemonfiles.com/37130/download-editpro.html navigates to the attacker’s page or loads the third-party content, the attacker receives the authorization response URL and can extract code or state (and potentially access_token).¶

• If the attacker impersonates a public client, the attacker can exchange the code for tokens at the respective token endpoint.¶
• For example, it is standard practice of reverse proxies to accept X-Forwarded-For headers and just add the origin of the inbound request (making it a list).
• If refresh tokens are issued, those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner.
• If the authorization server decides not to issue refresh tokens, the client MAY obtain a new access token by utilizing other grant types, such as the authorization code grant type.

In cases of access tokens obtained through grants where a resource owner is involved, such as the authorization code grant, the value of “sub” SHOULD correspond to the subject identifier of the resource owner. If the authorization server decides not to issue refresh tokens, the client MAY obtain a new access token by utilizing other grant types, such as the authorization code grant type. This specification gives recommendations beyond the scope of RFC6749 and clarifications.¶ RFC6749 also lays the foundation for further (implementation-specific) security measures, such as refresh token expiration and revocation as well as refresh token rotation by defining respective error codes and response behaviors.¶

The authorization server checks the credentials and, if successful, redirects the user agent to the client’s redirection endpoint.¶ At the authorization endpoint, a typical protocol flow is that the authorization server prompts the user to enter their credentials in a form that is then submitted (using the HTTP POST method) back to the authorization server. The authorization server SHOULD only automatically redirect the user agent if it trusts the redirection URI.

It is important to note that you shouldn’t limit your testing to just probing the redirect_uri parameter in isolation. The server can then check whether this matches the one it received in the initial authorization request and reject the exchange if not. More secure authorization servers will require a redirect_uri parameter to be sent when exchanging the code as well.

• However, CORS MUST NOT be supported at the authorization endpoint, as the client does not access this endpoint directly; instead, the client redirects the user agent to it.¶
• In the case of the authorization code flow, an attacker can potentially steal the victim’s code before it is used.
• It also allows the authorization server to sender-constrain the issued tokens (see Section 2.2).¶
• In any case, the PKCE challenge or OpenID Connect nonce MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started.

If an attacker is able to exfiltrate and successfully replay a refresh token, the attacker will be able to mint access tokens and use them to access resource servers on behalf of the resource owner.¶ It should be noted that audience restrictions — or, generally speaking, an indication by the client to the authorization server where it wants to use the access token — have additional benefits beyond the scope of token leakage prevention. Beyond this, to prevent PKCE downgrade attacks, the authorization server MUST ensure that if there was no code_challenge in the authorization request, a request to the token endpoint containing a code_verifier is rejected.¶ There is no way to detect such an injection attack in pure-OAuth flows since the token is issued without any binding to the transaction or the particular user agent.¶ An attacker can circumvent the countermeasures described above if they can modify the nonce or code_challenge values that are used in the victim’s authorization request.

Once they have stolen an access token, they can send a normal browser-based request to the OAuth service’s /userinfo endpoint, manually adding a new scope parameter in the process. Depending on the grant type, either a code or token is sent via the victim’s browser to the /callback endpoint specified in the redirect_uri parameter of the authorization request. For confidential clients, RFC6749 already requires that refresh tokens can only be used by the client for which they were issued.¶ Authorization servers MUST determine, based on a risk assessment, whether to issue refresh tokens to a certain client.