2

When using the web message response mode spec with OpenID Connect for silent authentication, what prevents an attacker leveraging an XSS attack from registering a "message" listener and intercepting authorization messages (a code or token, depending on the flow)?

In the spec, going off the Simple Mode, the Main Window creates an "Authorized Window" iframe and sets the source of that iframe to the authorization endpoint. If the user is authenticated, the Authorized Window uses the HTML5 messaging API to post a message to the Main Window. That message contains an authorization code in the code flow, or an id_token (and possibly an access token) in the implicit flow.

If an attacker successfully leverages an XSS attack, is there any way to prevent that attacker from listening to message events and intercepting a code/token?

As an aside, Auth0 support the web message response mode which is what got me thinking about this scenario. It can be used in a single-page application to refresh access tokens without reloading the page. Auth0 and the security community in general recommend against storing access tokens in local storage specifically because of XSS attacks. Does the web message response mode present another XSS attack vector?

Improve this question

1 Answer 1

Reset to default
0

Any response modes for SPAs won't prevent response parameter leakage via XSS.

However, you can use PKCE and store the PKCE code_verifier in memory, then only your JS caller can exchange given authorization code with access token.

Improve this answer
2
  • Right, but using a proof key doesn't prevent token interception which is what the question is about.
    – benbotto
    Jun 2, 2020 at 15:19
  • Implicit flow with Bearer token has no token interception prevention. One possible solution was Token Binding, but it failed to get wide adoption. Another solution could be DPoP Token, but it still has the difficulty to save private key which won't leak via XSS. And the other one is response_type=code w/ PKCE in SPA.
    – nov matake
    Jun 3, 2020 at 4:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .