3

Here are steps to setup a Google login button on a web client: https://developers.google.com/identity/sign-in/web/sign-in

When click on the Google login button this pops up:

enter image description here

All the interactions are between the IDP (Google) and the user's browser.

Is there anything that prevents a malicious app from copying/modifying the source code of the app, fake the good app and steal a valid token from the IDP when the user signs in?

1

When the user selects an account to sign in with, they are taken to a login page (if not currently logged in) and then/or sent "back" to the app in question, along with the SSO token. I say "back" because the user will be sent to the URL that was specified when the app was configured for SSO. That won't be the attacker's site; the attacker won't be able to see the SSO token.

Google (or other IDP) could also attempt to check where the user came to them from (checking the Referer header) to ensure that it's not some other web app spoofing the legitimate app's client ID, but that is probably not needed.

  • I am actually using this button following that doc form Google and there is a "popup" mode that doesn't use any redirect, hence my question. – ben Sep 7 '18 at 23:38
  • ux_mode "The UX mode to use for the sign-in flow. By default, it will open the consent flow in a popup. Valid values are popup and redirect." developers.google.com/identity/sign-in/web/reference – ben Sep 7 '18 at 23:40
  • Interesting. The question is then how the sign-in window communicates back to the app window, if not via a redirect. The most likely option would be a cross-site XHR (CORS request) from the app to Google, which would send the site's domain in the Origin header. Google could (and should) verify that the Origin header is valid for the site, in that case. With that said, this is speculation. I'd have to see the script, or watch the network traffic, to know for sure. – CBHacking Sep 8 '18 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.