2

I have recently started working with the OAuth2 authentication flow. In using it, I see that in the authcode flow, the client allows the AuthServer to authenticate a user, and then returns an authentication code to the client, which the client will then exchange for a token.

The authentication code can be small: as little as 10 Hex digits. Is this really secure? If a malicious client were able to steal legitimate client credentials, couldn't it do an impersonation attack by simply brute-force trying many authentication codes until it found one that worked? Is this a weakness in the Oauth2 authcode flow?

Or is the length of the auth code an implementation detail left up to the authentication server?

0

1 Answer 1

1

Or is the length of the auth code an implementation detail left up to the authentication server?

Yes, the auth code is an implementation detail left up to the authentication server, but the OAuth 2 RFC has several design requirements - most notably:

  • Short code lifetime.
  • Code is usable once. Attempting to use it more than once revokes tokens tied to that code.

The "usable once" feature means that even if an attacker can obtain/guess the code, any resubmissions to the auth server would (if possible) revoke tokens associated with that code. This is both good and bad. Good because it limits the attacker's window of opportunity. Bad because it could be used as a denial of service attack.

The authentication code can be small: as little as 10 Hex digits. Is this really secure?

Yes. To mitigate against brute force attacks, code generation entropy needs to account for frequency of calls to the token endpoint (rate limiter can help) during its lifetime. For example, if we go with your 10 hex digits, code lifetime of 30 seconds, and attacker can submit 1000 guesses per second: probability of guessing is in the order of 1 in 270 million - you can further improve on this by picking a better character set than hex (16) such as base 64, and reduce the code's lifetime.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .