1

Using OAuth to implement social login is insecure (https://www.rfc-editor.org/rfc/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the local application incorrectly thinks that, because a certain Access Token returns ID information, the user with that ID has been authenticated by the OAuth provider, and so can be authenticated as the corresponding user in the local application.

In contrast to the above, OIDC performs authentication and returns an ID Token, for which the local application is the audience. As such, can an ID Token be used to securely authenticate users, assuming that the ID Token is used immediately when returned from the token endpoint? Are there any obvious security ramifications to this approach?

Improve this question
1
  • 2
    Yeah, this is ok and a widely used pattern. I don't quite understand the link, I think it's talking about a potential threat, not an inherent flaw. Lots of apps use OAuth 2 for federated authentication, and while it's somewhat prone to implementation flaws, it can be done securely. OpenID Connect is based on OAuth 2 and designed for authentication. The main security ramification is that you have to trust the user's identity provider, so this is generally not suitable for high security apps like online banking.
    – paj28
    May 10, 2020 at 17:47

1 Answer 1

Reset to default
3

Social Login is an umbrella term that equates to a number of implementation options/architectures. The underlying protocol you would have to use depends on the identity provider. OpenID Connect was designed for authentication and the id_token can be used by the relying party for this very purpose.

...but not all major social platforms support OpenID Connect. For example, as of this writing Facebook Login is based on oAuth. As you correctly noted, oAuth is an authorization framework and a loose one at that. Therefore Facebook rolled out Login as a set of libraries that do everything for you and cover the authentication use case in a Facebook-proprietary way in addition to standard oAuth-ish authorization.

For platforms such as Google that do support OpenID Connect, the devil is in the details and that includes "security ramifications". Good news: a lot of threat modeling work has already been done on OpenID Connect. Bad news: it's complicated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .