Let's see the following scenario:
- "GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut".
- Alice logged in to GutHib with her password and 2FA, providing a strong proof that she really is the one who the registered account belongs to. (Let's assume she did well keeping her password and 2FA information safe, and no one else can access her account.)
- Alice set remember me to true at login, so she does not need to log in every time she wants to browse on GutHib.
- After 3 months of the first & only login to GutHib, Alice accidentally left her laptop open in a café while paying with her phone at the cash register. An attacker came to the laptop, opened GutHib, and since Alice set the remember me to true, the attacker could access the site's functionality while impersonating Alice, and clicked on "Transfer repository ownership" button at an important repository's admin page. This only required to be logged in, so one of Alice's important repos were stolen.
With applying re-authentication for this sensitive & destructive writer operation, GutHib could have prevented stealing Alice's code: the password is only known by her, also the phone with the 2FA app was also at her.
api/transfer-repository endpoint could require an elevated session type based on password/2FA re-entry (e.g.
TwoFactorSession, valid for 10min), or even a
OneTimeSession acquired with the
TwoFactorSession, which is specifically requested and signed for one particular endpoint call (valid only for the next endpoint call it is requested for).
How come that today's industry standards or best practices do not support these re-authentication flows?
- Is there a standardized way to ensure that the user making a request to a server endpoint (which performs a sensitive, destructive writer action) really sits in front of the computer and is the same user who logged in 3 months ago with remember me, and not a malicious attacker?
- This a real attack model. How come this is not supported by today's authentication & authorization industry standards like OpenID Connect & OAuth 2.0? Am I missing something?