Considerations when displaying OpenID and WS-* output to an end user

Question

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.

I would like to create a page that decryption the current session's OpenID or WS-* token, and display it in a special diagnostic page. What should I expose and not expose to prevent a replay attack? I'm not concerned with information disclosure.

Is it sufficient to place it on a HTTPS page accessed using validated POST requests?

My intent in asking this question is to learn how valuable certain fields are in a given authentication response.

Answer 1

What are you wanting to protect against when showing the token? Replay attack? Information disclosure? Etc?

if the site is simply for the sake of testing token handling, then its acceptable to show the whole token as-is because they shouldn't be using a token from a production system.

If an attacker has the full token then they can replay it, allowing them to potentially impersonate the user. They could also replay it against other applications potentially if the token is not encrypted (or the applications share the same decryption key). Also, if the token contains claims with secrets or PII then an attacker could collect that information.

With all that being said, the token is useless for authentication if you strip out the signature (well, assuming the application actually validates the signature).

EDIT: If you want to show the full token but prevent replay attacks, just keep an entry for that token by taking a hash of it. WIF supports the token cache, which is designed partially for that reason, but you'd have to right a custom implementation.