RFC7636ã¨ã—ã¦ç™ºè¡Œã•ã‚ŒãŸOAuth PKCEã¨ã¯ - r-weblifeãŠã²ã•ã—ã¶ã‚Šã§ã™ã€ritouã§ã™ã€‚ 今日ã¯å®¶ã§é¢¨é‚ªæ²»ã—ã¦ã¾ã—ãŸãŒã€TLã«æµã‚Œã¦ããŸæ¬¡ä¸–代ãªã‚“ã¡ã‚ƒã‚‰ã®è©±é¡Œã«ä¹—ã£ã‹ã£ã¦ã€ã–ã£ãã‚Šã¨ã—ãŸä»•æ§˜ç´¹ä»‹ã§ã™ã€‚ ベンダー個別ã®ãƒ‘スワード管ç†ã«ã¯èª²ç¨Žã›ã‚ˆï¼ï¼Ÿ 次世代Webカンファレンス『identity〠#nextwebconf #nextwebconf407 - Togetter OAuth PKCEãŒRFC7636ã¨ã—ã¦ç™ºè¡Œã•ã‚Œã¾ã—ãŸã€‚ | @_Nat Zone RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients 一言ã§ã„ã†ã¨ ã“ã®è¦æ ¼ã¯OAuth 2.0 [RFC6749]ã®Public Client ã® Code Interception Attack 脆弱性ã«å¯¾å¿œã™ã‚‹ã‚‚ã®ã§ã€ephemeral keyを生æˆã—ã¦ã€ã“れを使ã£ãŸProof of Possession of
Twitter Login ã«ã‚‚ CSRF 脆弱性ãŒã§ãã‚„ã™ã„ç½ ãŒ!? - OAuth.jp
Covert Redirect is not new but.. A risk analysis and recommendations
OAuth 2 and Fragment encoding.
Implicit Flow ã§ã¯ Covert Redirect 㧠Token æ¼ã‚Œã‚‹ã - OAuth.jp
OAuth 2.0 ã®è„†å¼±æ€§ (!?) "Covert Redirect" ã¨ã¯ - OAuth.jp
OAuthã¨OpenIDã«æ·±åˆ»ãªè„†å¼±æ€§ã‹--Facebookãªã©å¤§æ‰‹ã‚µã‚¤ãƒˆã«å½±éŸ¿ã‚‚
Covert Redirect and its real impact on OAuth and OpenID Connect
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html
http://tetraph.com/covert_redirect/
GoogleãŒãƒã‚°ã‚¤ãƒ³èªè¨¼ã‚’強化ã€OAuth 2.0ã®æŽ¡ç”¨ä¿ƒã™
ユーザーèªè¨¼ã®æ‰‹æŠœã - æ–¹å‘
Cookie使ã£ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚‚èªå¯ã ã¨æ€ã†ã‚ã£ã¦è©± - r-weblife
ãªãœOpenID ConnectãŒå¿…è¦ã¨ãªã£ãŸã®ã‹ã€ãã®æ´å²çš„背景
Engineering – Foursquare – Medium
idcon 16レãƒãƒ¼ãƒˆ - mad-pã®æ—¥è¨˜
OAuth 2.0 Implicit Flowをユーザーèªè¨¼ã«åˆ©ç”¨ã™ã‚‹éš›ã®ãƒªã‚¹ã‚¯ã¨å¯¾ç–方法ã«ã¤ã„㦠#idcon - r-weblife
Googleã®OAuth 2.0実装ã«ãŠã‘ã‚‹Tokenç½®æ›æ”»æ’ƒã®é˜²ãŽæ–¹ - r-weblife
ãªã‚“ã¨ãªãOAuth怖ã„ã£ã¦æ€ã£ã¦ã‚‹ã‚„ã¤ã¡ã‚‡ã£ã¨æ¥ã„ - r-weblife
ãªã‚“ã¨ãªãOAuth怖ã„ã£ã¦æ€ã£ã¦ã‚‹ã‚„ã¤ã¡ã‚‡ã£ã¨æ¥ã„
{{#tags}}- {{label}}
{{/tags}}