Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source.

Are most app OAuth implementations exposing vulnerability because of obscured URL/origin?

Below are OSX and iOS apps... a web view (embedded web browser viewport without address bar) is created and the OAuth page is displayed without URL or SSL certificate - which could be easily spoofed and exploited with phishing techniques. The risk seems huge.

Cobook App on OSX

enter image description here

Trello App on iOS

enter image description here

share|improve this question
Indeed this seems like a huge risk. And even if the address was shown, how many non tech savy users would notice a scam? – cen Sep 15 '13 at 11:38

This does not violate the security section of the OAuth 2.0 RFC. However, the OAuth 2.0 threat model RFC mentions phishing. The issue of obscuring the origin of the authentication page is not listed... anywhere. As in, I have never herd of this problem and I don't believe it is documented.

One could make the argument that all authentication pages must always show their origin and show that they are protected with HTTPS. (Is your screen shot of an HTTPS page? There is no way to tell.) This is a medium/low risk vulnerability, and I think twitter should fix it. I recommend emailing, twitter takes security very seriously and they have a great security team.

share|improve this answer
I just added another example and clarified some language. The problem within apps is that the authentication webpage is not displayed in a first-class web browser... just in an embedded web viewport within the application - no address bar, protocol, or non-spoofable way to indicate if it is HTTPS. – Luke Sep 15 '13 at 2:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.