OAuth.jpã„ã¾ã¾ã§ Mix-up Attack 㯠Client ㌠AS 毎㫠redirect_uri を使ã„分ã‘ã¦ã„ã‚Œã°é˜²ã’ã‚‹ã¨ä¿¡ã˜ã‚‰ã‚Œã¦ãã¾ã—ãŸãŒã€ãã‚Œã˜ã‚ƒé˜²ã’ãªã„ケースもã‚るよã£ã¦ã®ãŒ OAuth ML ã«æŠ•ç¨¿ã•ã‚Œã¾ã—ãŸã€‚ ç´°ã‹ã„解説ã¯è‹±èªžèªã‚“ã§ã‚‚らã†ã¨ã—ã¦ã€ã‚·ãƒ¼ã‚±ãƒ³ã‚¹ã«ã™ã‚‹ã¨ã“ã†ã„ã†ã“ã¨ã§ã™ã€‚ Attacker AS ㌠(Display Name ã‚„ãƒã‚´ç‰ã‚’通ã˜ã¦) 一見 Honest Client ã«è¦‹ãˆã‚‹ã‚ˆã†ãª Client (Attacker Client) ã‚’ Honest AS ã«ç™»éŒ²ã—ã¦ãŠãå¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ User ㌠Attacker AS é¸ã‚“ã§ã‚‹ã®ã« Honest AS ã«é£›ã‚“㧠Approve ã—ã¦ã—ã¾ã£ã¦ã‚‹éƒ¨åˆ†ã‚‚ã€Attacker Proxy ãŒåˆ©ç”¨å¯èƒ½ãªçŠ¶æ³ (e.g., Client ㌠HTTP ãªã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆã§ Honest AS ã®ãƒã‚°ã‚¤ãƒ³ãƒœã‚¿ãƒ³ç‰ã‚’
GitHub - outmoded/oz: Web Authorization Protocol
https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/
The OAuth 2.0 Authorization Framework: Bearer Token Usage（日本語）
The OAuth 2.0 Authorization Framework
OpenID Foundation Japan - 翻訳・教育 Working Group
OAuth 2.0 ã® code ã¯æ¼ã‚Œã¦ã‚‚大丈夫ã£ã¦ãƒ›ãƒ³ãƒˆ!? - OAuth.jp
OAuth and Single Page JavaScript Web-Apps · Alex Bilbie
RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
{{#tags}}- {{label}}
{{/tags}}