Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.

I would like to create a page that decryption the current session's OpenID or WS-* token, and display it in a special diagnostic page. What should I expose and not expose to prevent a replay attack? I'm not concerned with information disclosure.

Is it sufficient to place it on a HTTPS page accessed using validated POST requests?

My intent in asking this question is to learn how valuable certain fields are in a given authentication response.

share|improve this question
add comment

1 Answer

What are you wanting to protect against when showing the token? Replay attack? Information disclosure? Etc?

if the site is simply for the sake of testing token handling, then its acceptable to show the whole token as-is because they shouldn't be using a token from a production system.

If an attacker has the full token then they can replay it, allowing them to potentially impersonate the user. They could also replay it against other applications potentially if the token is not encrypted (or the applications share the same decryption key). Also, if the token contains claims with secrets or PII then an attacker could collect that information.

With all that being said, the token is useless for authentication if you strip out the signature (well, assuming the application actually validates the signature).

EDIT: If you want to show the full token but prevent replay attacks, just keep an entry for that token by taking a hash of it. WIF supports the token cache, which is designed partially for that reason, but you'd have to right a custom implementation.

share|improve this answer
    
Yes, I'm interested in preventing a replay attack –  makerofthings7 Jul 23 '12 at 2:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.