We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider.
I am trying to understand how to use the state token passed in with the redirect URL during an OAuth "authorization flow".
How would the state token prevent the attack in the following scenario:
Assumption: The back-end OAuth client(which will service the REST API requests) has a session map of user <-> state token.
- Malicious user tries to authenticate with our service.
- Our service generates the authentication URL to OAuth provider with the state token. The state token is attached to the malicious user on our server.
- The malicious user authenticates himself on the authentication URL and traps the redirect URL request before hitting our server.
- Now assume that he manages to force a valid user of our service to navigate to the trapped redirect URL.
- The OAuth client(our server) on receiving the redirect URL would validate the state token, this is because:
- the OAuth code in URL would successfully exchanged by the OAuth provider with an ID token which matches the identity of the malicious user.
- the OAuth client(our server) would compare the state token in the URL with the state token associated with identity carried by the ID token.
- Now a valid user would end up operating on the malicious user's account and potentially reveal sensitive information to the malicious user.
How do we protect against such attacks? Or are we missing something in the way we are implementing state token validation.