Timeline for Id token contains sensitive information sent by the GET method
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 15, 2018 at 7:47 | comment | added | Geir Emblemsvag | I was hoping someone experienced with this OIDC behavior would answer, but to get the ball started I'm attempting an answer of my own:) | |
| Dec 15, 2018 at 7:46 | answer | added | Geir Emblemsvag | timeline score: 2 | |
| S Dec 14, 2018 at 8:54 | history | edited | forest | CC BY-SA 4.0 |
capitalization in title
|
| Dec 14, 2018 at 8:28 | comment | added | Steffen Ullrich |
@Ender: "...I've found that my website ..." - do you mean with "my" that this is a website you've setup to be public and which publishes your private information to everybody via id_token? Or do you just mean a website you've visited, i.e. these private data are only sent to you?
|
|
| Dec 14, 2018 at 8:25 | comment | added | Steffen Ullrich | @Ender: Saved in logs: this is likely only done at a server who already has your data anyway. Captured: not with proper HTTPS and if improper HTTPS or plain HTTP is used POST body could be captured as well. Displayed on screen: should only be done to somebody who already knows these data anyway. Shared with others: likely a problem since the average use does not know what he shares. | |
| Dec 14, 2018 at 7:51 | comment | added | Ender |
HTTPS or HTTP, I don't see the point here because HTTPS just encrypts the contents of it. With the id_token resides on the URL. It could be captured, saved in logs, URLs may also be displayed on-screen, bookmarked or emailed around by users. Yes it's submitted via web though. @SteffenUllrich
|
|
| Dec 14, 2018 at 6:55 | review | Suggested edits | |||
| S Dec 14, 2018 at 8:54 | |||||
| Dec 14, 2018 at 6:44 | comment | added | Steffen Ullrich |
"Because, if the attackers are able to capture the request,..." - first: was this transmitted with HTTP or HTTPS? Also, how were these sensitive information submitted in the first place, i.e. via web too and thus affected by the same risk as the id_token?
|
|
| Dec 14, 2018 at 5:59 | comment | added | Geir Emblemsvag | The OIDC standard allows, and even encourages this kind of behavior, in some places. For instance the id_token_hint. While it's allowed to POST the data, it's not required. But I agree with your sentiment... | |
| Dec 14, 2018 at 4:47 | history | asked | Ender | CC BY-SA 4.0 |