Upcoming security changes to Google's OAuth 2.0 authorization endpoint in embedded webviews- Google Developers Blog
Upcoming security changes to Google's OAuth 2.0 authorization endpoint in embedded webviews Share Facebook Twitter LinkedIn Mail Posted by Badi Azad, Group Product Manager (@badiazad) The Google Identity team is continually working to improve Google Account security and create a safer and more secure experience for our users. As part of that work, we recently introduced a new secure browser policy
The False Identifier Anti-pattern
Today, we’d like to highlight a dangerous anti-pattern in the identity world: the false identifier anti-pattern.  An anti-pattern is a common response to a recurring problem that’s usually ineffective and risks being highly counter-productive. You may have also heard of the password anti-pattern. Today's discussion represents a possibly even more dangerous practice. The false identifier anti-patte
Cå‘ã‘サービス㧠使ã‚ã‚Œã¦ã„ã‚‹èªè¨¼æ–¹å¼ã¨å®‰å…¨ãªä½¿ã„æ–¹
ã©ã“ã‹ã§ã“ã£ãã‚Šã‚„ã£ãŸå‹‰å¼·ä¼šã®è³‡æ–™ã‚’公開ã—ã¾ã™ã€‚
Basic Authentication Deprecation in Exchange Online – September 2022 Update
One month from today, we’re going to start to turn off basic auth for specific protocols in Exchange Online for customers who use them. Since our first announcement nearly three years ago, we’ve seen millions of users move away from basic auth, and we’ve disabled it in millions of tenants to proactively protect them. We’re not done yet though, and unfortunately usage isn’t yet at zero. Despite tha
2022å¹´5月末ã«åˆ©ç”¨ã§ããªããªã‚‹ã€ŒID/パスワードã®ã¿ã®Googleアカウントã¸ã®ãƒã‚°ã‚¤ãƒ³ã€ã¨ã¯ä½•ã‹
ã“ã‚“ã«ã¡ã¯ã€ritouã§ã™ã€‚ 昨日ã€ã“ã‚“ãªTweetã‚’ã—ã¾ã—ãŸã€‚ ã“ã‚Œã¯ä½•ã‹ã¨ã„ã†è©±ã§ã™ã€‚ ã„ããªã‚Šã¾ã¨ã‚ Googleã¸ã®ãƒã‚°ã‚¤ãƒ³ã®è©± ã§ã¯ãªã„ カレンダーやメールãªã©å¤ã‹ã‚‰ã®ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã¯ パスワードèªè¨¼ã‚’å‰æã¨ã—ãŸã‚‚ã®ãŒã‚ã‚‹ ãれ㌠OAuthã«ç½®ãæ›ã‚ã‚‹ 感㘠PIM系プãƒãƒˆã‚³ãƒ«ã¨ãƒ‘スワードèªè¨¼(èªå¯ï¼Ÿ) ã“ã®ãƒã‚¿ã©ã“ã‹ã«æ›¸ã„ãŸæ°—ãŒã™ã‚‹ãª...ã£ã¦ã®ã§æŒ¯ã‚Šè¿”ã‚‹ã¨ã€ãƒ¡ãƒ¼ãƒ«ã«ã¤ã„ã¦ã“ã®å‰è¨˜äº‹æ›¸ã„ã¦ã¾ã—ãŸã€‚ 今回もåŒã˜è©±ã§ã™ã。一部を除ã„ã¦ã“ã‚Œã®ãƒªãƒŸãƒƒãƒˆãŒæ¥ãŸã£ã¦ã¨ã“ã‚ã§ã—ょã†ã€‚ OIDCã˜ã‚ƒãªã„ã®ã‹ï¼Ÿã¨ã„ã†ã¨ã“ã‚ã¯ã€ã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼ã‚„メールã€ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ–ãƒƒã‚¯æƒ…å ±ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒç›®çš„ãªã®ã§ã‚„ã£ã¦ã‚‹ã“ã¨ã¯ãƒªã‚½ãƒ¼ã‚¹ã‚¢ã‚¯ã‚»ã‚¹ã€ãªã®ã§OAuth 2.0ã™ã。 æ ¡é•·ã€ŒGoogleãŒPIMç³»ã®ãƒ‘スワードèªè¨¼ã‚’駆é€ã—始ã‚ã‚‹ã¾ã§ã«12å¹´ã‹ã‹ã‚Šã¾ã—ãŸã€‚ã€
サーãƒã‚µã‚¤ãƒ‰ã§JWTã®å³æ™‚無効化機能をæŒã£ã¦ã„ãªã„サービスã¯è„†å¼±ãªã®ã‹ï¼Ÿ - ãã‚ã®é›‘記帳
ãã£ã‹ã‘ 昨年(2021å¹´9月ã”ã‚)ã«å¾³ä¸¸ã•ã‚“ã®ã“ã®ãƒ„イートを見ã¦ã€ã€Œ2022å¹´ã«ã¯JWTを用ã„ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«ä»£è¡¨ã•ã‚Œã‚‹ã€ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãªã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã¯ä¸–ã®ä¸ã«å—ã‘入れられãªããªã£ã¦ã„ãã®ã ã‚ã†ã‹ï¼Ÿã€ã¨æ€ã£ã¦ã„ã¾ã—ãŸã€‚ OWASP Top 10 2021 A1ã«ã€ŒJWT tokens should be invalidated on the server after logout.ã€ï¼ˆç§è¨³:JWTトークンã¯ãƒã‚°ã‚¢ã‚¦ãƒˆå¾Œã«ã‚µãƒ¼ãƒãƒ¼ä¸Šã§ç„¡åŠ¹åŒ–ã™ã¹ãã§ã™ï¼‰ã¨æ›¸ã„ã¦ã‚ã‚‹ã‘ã©ã€ã©ã†ã‚„ã£ã¦ç„¡åŠ¹åŒ–ã™ã‚‹ã‚“ã ? ブラックリストã«å…¥ã‚Œã‚‹?https://t.co/bcdldF82Bw— 徳丸 浩 (@ockeghem) 2021å¹´9月10æ—¥ JWT大好ããªçš†ã•ã‚“ã€ã“ã“ã¯ã‚¦ã‚©ãƒƒãƒã—ãªã„ã¨ã ã‚ã§ã™ã‚ˆã€‚ã“ã‚ŒãŒãã®ã¾ã¾é€šã£ãŸã‚‰ã€ãƒã‚°ã‚¢ã‚¦ãƒˆæ©Ÿèƒ½ã§JWTã®å³æ™‚無効化をã—ã¦ã„ãªã„サイトã¯è„†å¼±æ€§è¨ºæ–ã§ã€ŒOWASP Top
Facebookã‹ã‚‰OAuthã‚’åœæ¢ã•ã‚Œã¦ã‚ã‹ã£ãŸä»Šæ™‚ã®ã‚»ã‚ュリティ - Uzabase for Engineers
NewsPicksã®é«˜å±±ã§ã™ã€‚ ã“ã®è¨˜äº‹ã¯Uzabase Advent Calendar 2021ã®23日目ã®è¨˜äº‹ã§ã™ã€‚昨日ã¯æˆ‘らãŒèµ¤æ¾¤å‰›ã•ã‚“ã«ã‚ˆã‚‹AWS Organizationã®è¨˜äº‹ã§ã—ãŸã€‚ 去る2021å¹´10月12æ—¥ã«çªç„¶NewsPicksã®ã‚µãƒ¼ãƒ“スã§Facebookãƒã‚°ã‚¤ãƒ³ã‚„Facebookã¸ã®æŠ•ç¨¿ãŒã§ããªããªã‚Šã¾ã—ãŸã€‚ã“ã®çŠ¶æ…‹ã¯12月13æ—¥ã¾ã§2ヶ月もã®é–“継続ã—ã¦ã„ã¦ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã•ã‚“ã«ã¯ä¸ä¾¿ã‚’å¼·ã„ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ ç±³Facebook本社ã¨ãƒ¡ãƒ¼ãƒ«ã§ã‚„ã‚Šã¨ã‚Šã—ã¦ã„ã¾ã—ãŸãŒã€ãƒ¡ãƒ¼ãƒ«è¿”ä¿¡ã«ä½•é€±é–“ã‚‚å¾…ãŸã•ã‚Œã€Facebook日本法人ã«åŠ©ã‘ã¦ã‚‚らã£ã¦ã‚ˆã†ã‚„ã解決ã«è‡³ã‚‹ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ ã“ã®è‹¦åŠ´è©±ã¯ã„ãらã§ã‚‚ã§ãã‚‹ã®ã§ã™ãŒã€ä»Šå›žã¯ã‚»ã‚ュリティã®åˆ‡ã‚Šå£ã§æ›¸ã„ã¦ã„ãã¾ã™ã€‚ Facebookã®ã€Œãƒ‡ãƒ¼ã‚¿ä¿è·è©•ä¾¡ã€ データセã‚ãƒ¥ãƒªãƒ†ã‚£é …ç›® 「ã™ã¹ã¦ã®ãƒ—ラットフォームデータストレージ(ã™ã¹ã¦ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹
Secure Browser Storage: The Facts
Auth0 Marketplace Discover and enable the integrations you need to solve identity Explore Auth0 Marketplace I recently gave a talk at OWASP Virtual AppSecIL 2020 on “Security Facts and Fallacies about Browser Storage,†where I presented the different browser storage options and the security guarantees they offer. When talking about browser storage and security, the top 1 concern is an XSS vulnerab
Introducing: The OAuth 2 Game
OAuth 2Introducing: The OAuth 2 GameA fun and easy way to learn about OAuth What is The OAuth 2 Game?The OAuth 2 game is a fun and easy way to learn about how to use OAuth to protect the most common types of applications. The OAuth 2 specification lists different ways of obtaining access tokens meant to leverage the different capabilities and security characteristics of distinct client (applicatio
アクセストークンをWebWorkerã§æ‰±ã† - console.lealog();
ã¨ã„ã†ã‚¢ãƒ—ãƒãƒ¼ãƒã‚’紹介ã—ã¦ã‚‹è¨˜äº‹ãŒã‚ã£ã¦ã€ãªã‚‹ã»ã©ï¼Ÿã¨æ€ã£ãŸã®ã§ã¾ã¨ã‚ã¦ã¿ã‚‹ã€‚ 元記事ã¯ã“ã¡ã‚‰ã€‚ Leveraging Web Workers to Safely Store Access Tokens – The New Stack 毎度ã®ã“ã¨ãªãŒã‚‰ã€ä»Šã«ã¯ã˜ã¾ã£ãŸã“ã¨ã§ã¯ãªã„。 元記事ã„ã‚ã WebWorkerã§ã‚ã‚Œã°ã€ãƒ¡ã‚¤ãƒ³ã‚¹ãƒ¬ãƒƒãƒ‰ã§å®Ÿè¡Œã•ã‚Œã‚‹ã§ã‚ã‚ã†XSSã‚„3rdã®ã‚³ãƒ¼ãƒ‰ã‹ã‚‰è§¦ã‚Œãªã„ã®ã§å®‰å…¨ï¼ è¨è¨ˆã¨ã—ã¦ã¯ã€ メイン: ã¾ãš`Worker`ã‚’ãƒãƒ¼ãƒ‰ メイン: åˆæœŸåŒ–ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’`postMessage()` クレデンシャルãŒã‚ã‚‹ãªã‚‰ãれを渡㙠ワーカー: アクセストークンã®æº–å‚™ å—ã‘å–ã£ãŸã‚„㤠or ãã“ã§`fetch()`ã—ã¦ã€ã‚ªãƒ³ãƒ¡ãƒ¢ãƒªã«ä¿å˜ （ã“ã‚Œã§æº–å‚™OK） メイン: APIã«ãƒªã‚¯ã‚¨ã‚¹ãƒˆã—ã¦ã»ã—ã„ã¨`postMessage()` ワーカー: APIã«å‘ã‘ã¦ã‚¢ã‚¯ã‚»ã‚¹ãƒˆãƒ¼ã‚¯ãƒ³
2. OAuth 2.0 Security Best Current Practice - Authlete
ã“ã®ãƒ“デオã«ã¤ã„㦠ã“ã®ãƒ“デオã¯ã€2020 å¹´ 1 月 31 æ—¥ã«é–‹å‚¬ã—ãŸå¼Šç¤¾å‹‰å¼·ä¼šã®ãƒ—レゼンテーション録画ã®ãƒ‘ート 2 ã§ã™ã€‚ ç–定ãŒé€²ã‚€ OAuth 2.0 Security Best Current Practice ã«é–¢é€£ã™ã‚‹ã€å‘¨è¾ºä»•æ§˜ã®æ¦‚è¦ã«ã¤ã„ã¦ã€ Authlete ã®å·¥è—¤é”雄ãŒç´¹ä»‹ã—ã¾ã™ã€‚ æ–‡å—èµ·ã“ã—（ãƒã‚°ã‚’å…ƒã«å†æ§‹æˆï¼‰ OAuth 2.0 Security BCP ã®æ¦‚è¦ å·¥è—¤: ã¾ãšã²ã¨ã¤ç›®ãŒã€ãƒ™ã‚¹ãƒˆã‚«ãƒ¬ãƒ³ãƒˆãƒ—ラクティスã€ã‚»ã‚ュリティBCP ã§ã™ã€‚ ã‚‚ã¨ã‚‚㨠"OAuth 2.0" (RFC 6749)ã€"Bearer Token Usage" (RFC 6750)ã€"Threat Model" (RFC 6819) ã¨ã„ㆠRFC ãŒã‚ã£ã¦ã€ ã“ã®ä¸ã« Security Considerations ãŒã€æ›¸ã„ã¦ã¯ã‚ã‚‹ã‚“ã§ã™ã。 ãŸã 2012 å¹´ã€ã‚‚ã†ã¡ã‚‡ã£ã¨ã„ã†ã¨ãã®
OAuth 2.0 Security Best Current Practice
OAuth 2.0 Security Best Current Practice Abstract This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFC 6749, RFC 6750, and RFC 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0. Further, it deprecates so
OAuth 2.1を見守る会
02ã¨03ã®å·®åˆ†ã‚’調ã¹ã¾ã—ãŸã€‚ 構æˆå¤‰æ›´ãŒã‚ã£ã¦å·®åˆ†ãŒãŸãã•ã‚“ã‚るよã†ã«è¦‹ãˆã¾ã™ãŒã€ç‰¹ã«æ–°ã—ã„物ã¯è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ 次回ã«æœŸå¾…ã—ã¾ã—ょã†ã€‚
OAuth 2.1ã®å·®åˆ†ã‚’見守る会 : draft 01-02
ritou ã§ã™ã€‚ 本投稿ã¯OAuth 2.1ã£ã¦å‘¼ã°ã‚ŒãŸã„感を出ã—ã¦ã‚‹ä»•æ§˜ã®å·®åˆ†ã‚’見守る会ã§ã™ã€‚ 本投稿å«ã‚ã€å·®åˆ†ã‚’ スクラップ - OAuth 2.1を見守る会 ã§ã¾ã¨ã‚ã¦ã„ã¾ã™ã€‚ 3月ã«ãƒ‰ãƒ©ãƒ•ãƒˆãŒ01ã‹ã‚‰02ã«ãªã£ã¦ãŸã®ã‚’放置ã—ã¦ã„ãŸã®ã§ã€ãã®å·®åˆ†ã‹ã‚‰ã©ã‚“ãªéƒ¨åˆ†ãŒå¼·èª¿ã•ã‚ŒãŸã‚Šèª¬æ˜ŽãŒè¿½åŠ ã•ã‚ŒãŸã®ã‹ãªã¨ã„ã†ã®ã‚’見ã¦ã„ãã¾ã™ã€‚ ã“ã®ã‚„ã‚Šæ–¹ã€æ–°ã—ã„仕様ã«ãŠã„ã¦ã¯æœ€çµ‚çš„ã«RFCã«ãªã‚‹ã‚‚ã®ã«å«ã¾ã‚Œãªã„内容ã«è§¦ã‚Œã‚‹ã“ã¨ã‚‚ã‚ã‚Šã€çµŒç·¯ãªã‚“ã¦ã™ã£é£›ã°ã—ã¦å‡ºæ¥ä¸ŠãŒã£ãŸã‚‚ã®ã‚’ã„ãŸã ãæ´¾ã«ã¯ç„¡é§„ã«æ€ãˆã‚‹ä½œæ¥ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。 ã—ã‹ã—ã€ã“ã®OAuth2.1ã£ã¦ã®ã¯ã“ã‚Œã¾ã§å‡ºã•ã‚ŒãŸä»•æ§˜ã¨ãƒ™ã‚¹ãƒˆãƒ—ラクティスをè¸ã¾ãˆãŸã‚‚ã®ãªã®ã§ã€ãã£ã¨ç„¡é§„ã«ã¯ãªã‚‰ãªã„ã¯ãšã€‚ 早速見ã¦ã„ãã¾ã—ょã†ã€‚ 差分 差分 目次 目次ã‹ã‚‰è¦‹ãˆã‚‹å·®åˆ†ã¨ã—ã¦ã¯ Client Password 改゠Client Secret Refresh Token
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
OAuth 2.0 for Browser-Based Apps
Basic Authentication Deprecation in Exchange Online – May 2022 Update
Basic Authentication and Exchange Online – September 2021 Update
OAuth 2.0 Authorization Code Flow with PKCE
Announcing OAuth 2.0 beta - Announcements - Twitter Developers
SPA with Implicit Grant - handling token refresh · Issue #1218 · aws-amplify/amplify-js
{{#tags}}- {{label}}
{{/tags}}