OAuth 2.0 ã® code ã¯æ¼ã‚Œã¦ã‚‚大丈夫ã£ã¦ãƒ›ãƒ³ãƒˆ!? - OAuth.jp昨日ã®Covert Redirect 㧠Query æ¼ã‚Œã‚‹ã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹!?ã‚„OAuth 2.0 ã®è„†å¼±æ€§ (!?) “Covert Redirect†ã¨ã¯ã«ã‚るよã†ã«ã€OAuth 2.0 ã® code ãŒæ¼ã‚Œã¡ã‚ƒã†ã“ã¨ã‚‚ã€ã‚ã‚Šãˆã¾ã™ã€‚ æ¼ã‚Œãªã„ãŸã‚ã«ã‚„ã‚‹ã¹ãã“ã¨ã¯ã€ä¸Šè¨˜ã®è¨˜äº‹ã‚„Facebook Login 㧠Covert Redirect を防æ¢ã™ã‚‹ãªã‚“ã‹ã§ã‚‚紹介ã—ã¦ã‚‹ã®ã§ã€ãã¡ã‚‰èªã‚“ã§ãã ã•ã„。 ã§ã€ä»Šå›žã®å†…容ã¯ã€Œcode ãŒæ¼ã‚ŒãŸã‚‰ä½•ãŒã¾ãšã„ã®ã‹ã€ã«ã¤ã„ã¦ã§ã™ã€‚ 「code ã¯æ¼ã‚Œã¦ã‚‚大丈夫ã€èª¬ 「Covert Redirectã€ã«ã¤ã„ã¦ã® John Bradley æ°ã®è§£èª¬ï¼ˆè¿½è¨˜ã‚り）ã«ã‚‚ã€ã“ã†ã‚ã‚Šã¾ã—ãŸã。 OAuth 㨠OpenID Connect ã«ã¯è¤‡æ•°ã® response_type ãŒã‚ã‚‹ã‚“ã ã‘ã©ã€ã•ãã®ãƒªãƒãƒ¼ãƒˆã®è‘—者ã¯ã€æœ€ã‚‚一般的㪠response_type ãŒ
Facebook Login 㧠Covert Redirect を防æ¢ã™ã‚‹ - OAuth.jp
OpenID 2.0 ã«ãŠã‘ã‚‹ Covert Redirect 㨠RP Discovery - OAuth.jp
Covert Redirect is not new but.. A risk analysis and recommendations
オオカミãŒæ¥ãŸï¼šäººæ°—ã®ã‚ªãƒ¼ãƒ—ンソースセã‚ュリティソフトウェアã§ã¾ãŸ1ã¤å¤§ããªè„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸï¼Ÿï¼ãƒ¼CNETãŒãƒ€ãƒ¡ãƒ€ãƒ¡ãªä»¶
事務局ブãƒã‚°ï¼šã€ŒCovert Redirectã€ã«ã¤ã„ã¦ã® John Bradley æ°ã®è§£èª¬ - 訂æ£ç‰ˆ
OAuth 2 and Fragment encoding.
Implicit Flow ã§ã¯ Covert Redirect 㧠Token æ¼ã‚Œã‚‹ã - OAuth.jp
Covert Redirect Vulnerability with OAuth 2
OAuth 2.0 ã®è„†å¼±æ€§ (!?) "Covert Redirect" ã¨ã¯ - OAuth.jp
事務局ブãƒã‚°ï¼šã€ŒCovert Redirectã€ã«ã¤ã„ã¦ã® John Bradley æ°ã®è§£èª¬ï¼ˆè¿½è¨˜ã‚り）
OAuthã¨OpenIDã«æ·±åˆ»ãªè„†å¼±æ€§ã‹--Facebookãªã©å¤§æ‰‹ã‚µã‚¤ãƒˆã«å½±éŸ¿ã‚‚
Covert Redirect and its real impact on OAuth and OpenID Connect
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html
http://tetraph.com/covert_redirect/
{{#tags}}- {{label}}
{{/tags}}