3

If a service allows you to create OAuth tokens without any scopes (allowing 5k API requests / hour for public resources), is it dangerous to share these tokens publicly?

The obvious problem I see is that anyone will be able to use this token reaching the request limit of the user that shared the token.

Are there any other problems when sharing such a token publicly?

What if the service allows you to update the OAuth scopes of the same token without regenerating the token?

1

Some issues I can think of are:

  • Exhausting the request limit, preventing any user's depending on that token from using it
  • Violating the terms of service agreement by sharing a token which is supposed to remain secret/in the possession of a single user
  • If the API is subject to such a vulnerability, exploitation of 'session fixation', where another user authenticates or calls a privilege escalation method which upgrades the privileges available to the token without changing it (thereby enabling access to that user's account for all holders of the token)
  • Some API methods might vary their response based on calls to other methods (or the same method). If you know applications are depending on certain formats for a response (e.g. XML or JSON) you could leverage this to force the trusted end-point (the exposed API) to attack whichever application is using it, because you will be sharing a session.
  • Thanks! In a particular case, the token can be updated with more scopes (like write/delete), without changing the token. I guess this can be also a thing, right? – Ionică Bizău Jan 18 '16 at 10:23
  • @IonicăBizău Yes, I think that is session fixation you're describing. See if this OWASP description matches what you think: owasp.org/index.php/Session_fixation – deed02392 Jan 18 '16 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.