3

If a service allows you to create OAuth tokens without any scopes (allowing 5k API requests / hour for public resources), is it dangerous to share these tokens publicly?

The obvious problem I see is that anyone will be able to use this token reaching the request limit of the user that shared the token.

Are there any other problems when sharing such a token publicly?

What if the service allows you to update the OAuth scopes of the same token without regenerating the token?

1 Answer 1

1

Some issues I can think of are:

  • Exhausting the request limit, preventing any user's depending on that token from using it
  • Violating the terms of service agreement by sharing a token which is supposed to remain secret/in the possession of a single user
  • If the API is subject to such a vulnerability, exploitation of 'session fixation', where another user authenticates or calls a privilege escalation method which upgrades the privileges available to the token without changing it (thereby enabling access to that user's account for all holders of the token)
  • Some API methods might vary their response based on calls to other methods (or the same method). If you know applications are depending on certain formats for a response (e.g. XML or JSON) you could leverage this to force the trusted end-point (the exposed API) to attack whichever application is using it, because you will be sharing a session.
2
  • Thanks! In a particular case, the token can be updated with more scopes (like write/delete), without changing the token. I guess this can be also a thing, right? Jan 18, 2016 at 10:23
  • @IonicăBizău Yes, I think that is session fixation you're describing. See if this OWASP description matches what you think: owasp.org/index.php/Session_fixation
    – deed02392
    Jan 18, 2016 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .