OpenID 2.0 ã«ãŠã‘ã‚‹ Covert Redirect 㨠RP Discovery - OAuth.jpã•ã¦ã€OAuth 2.0 & OpenID Connect ã«ãŠã‘ã‚‹ Covert Redirect ã®å•é¡Œ ã«ã¤ã„ã¦ã¯ã¾ã¨ã‚ãŸã®ã§ã€æ¬¡ã¯ OpenID 2.0 ã«ã¤ã„ã¦ã§ã™ã€‚ ã„ã„ã§ã™ã‹ã€OpenID Connect ã§ã¯ãªãã€OpenID 2.0 ã§ã™ã‚ˆã€‚å¤ã„æ–¹ã§ã™ã€‚æ‡ã‹ã—ã„ã§ã™ãã€OpenID Authentication 2.0 – Final。 ãã†ã„ãˆã°ã€OpenID Foundation Japan ã®ç¿»è¨³ WG ã‚’ç«‹ã¡ä¸Šã’ã¦ã€ä¸€ç•ªæœ€åˆã«ç¿»è¨³ã—ãŸã®ãŒ OpenID Authentication 2.0 㮠日本語訳ã§ã—ãŸã…(é ã„ç›® ã¨ã€æ˜”話ã¯ãã‚Œãらã„ã«ã—ã¦ã€æœ¬é¡Œã«å…¥ã‚Šã¾ã—ょã†ã€‚ ã¾ãšã¯ Covert Redirect 発生æ¡ä»¶ã«ã¤ã„㦠OpenID 2.0 ã§ã¯ã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ‘ラメータ㯠query ã«å¼•ã£ä»˜ã„ã¦ãã¾ã™ã€‚fragment ã¯ä½¿ã„ã¾ã›ã‚“。 ãªã®ã§ã€open r
Covert Redirect is not new but.. A risk analysis and recommendations
OAuth 2 and Fragment encoding.
Implicit Flow ã§ã¯ Covert Redirect 㧠Token æ¼ã‚Œã‚‹ã - OAuth.jp
OAuth 2.0 ã®è„†å¼±æ€§ (!?) "Covert Redirect" ã¨ã¯ - OAuth.jp
OAuthã¨OpenIDã«æ·±åˆ»ãªè„†å¼±æ€§ã‹--Facebookãªã©å¤§æ‰‹ã‚µã‚¤ãƒˆã«å½±éŸ¿ã‚‚
Covert Redirect and its real impact on OAuth and OpenID Connect
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html
http://tetraph.com/covert_redirect/
{{#tags}}- {{label}}
{{/tags}}