I have an authorization handler of the form:

Auth(AllowedGroups, Token) -> [Allow/Deny]

Where the Token consist of the following tuple and its MAC tag.

TbsToken := (userid, usergroup, expiration)
Token    := (TbsToken, MAC)

The MAC key resides on the servers' sides, and along with the authorization handler, is used for automatic authentication with server B once user is logged onto server A.

A while ago

Now server B gets the new function of serving objects to invitees that appear anonymous to the server. To determine which object to serve, 120-bit (padding-free in base32) random ID of the object is passed to the access point.

Along with the ID, is the said token with "userid" removed (because anonymous) and "usergroup" replaced with the object ID. And the authorization handler is reused and called as:

Auth(ID, ((anon, ID, future), MAC))

It raises an alarm in me because the "AllowedGroups" is now controlled by the client, but I cannot see obvious ways this leads to vulnerability.

Is the authorization handler call 1) useful but may need tweaking? 2) useless as ID is already random, or 3) a security concern that must be removed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.