Tag Info

New answers tagged

2

OAuth is flexible, and sometimes the OAuth flow is modified for application specific needs. The most common two flows are 2-legged and 3-legged, which if these flows are implemented correctly, then they are generally accepted as secure. The proposed CORS AJAX implementation of the OAuth flow violates two security requirements of RFC-6749 - OAuth 2.0 ...


0

As others have already explained, referrers can be easily spoofed. Also, according to the HTTP standard, they are entirely optional. There are privacy settings and addons for some browser which always suppress referrers and there is nothing malicious about that. For that reason I would recommend you to consider no referrer a correct referrer and only reject ...


0

Short answer: no. Long answer: it depends. Referer is a header sent and controlled by the client. You cannot trust any data coming unchecked from the client. As others pointed out, it can be easily manipulated. It can contain anything the attacker wants, so don't rely on it. If your URL contain any crypto ...


0

The best way, probably, would be to demonstrate to the management how easy this security measure can be circumvented. You can use e.g., the Burp Proxy (http://portswigger.net/burp/download.html) to intercept and modify/add referer header. Download and install the Burp proxy (there is a Free Edition). Configure your browser to use the Burp proxy. Use the ...


2

It will pick off the low hanging fruit, but in general, it is not hard to spoof a header. I would say that if it has caused issues in the past, it is more than likely not worth the risk to your business apps.


0

The metadata file doesn't have any sensitive information in it. It provides information that the SP can use to trust an assertion coming from [IdP] (so no one else can claim to be [IdP]). The typical information it contains are: SSO URL, issuer name, and the certificate containing the PKI "public" key. All of these are pretty much public anyway (as any user ...



Top 50 recent answers are included