I have examined a web application, and I have found some strange behaviour of tokens. I will try to explain it.

I think OAuth2 is used for authorization.

User Alice will login to the app, in the HTTP headers there is an item Authorization: alice_token.

User Bob will login to the app, in the HTTP headers there is also an item Authorization: bob_token.

However if I take alice_token and inject it to HTTP headers of Bob, I can see in the web application everything like Alice, even though I am still logged in as Bob (it will not switch the account, I only get data which is not Bob's).

I know, that in real situation it will not be easy to steal alice_token, because communication is encrypted (HTTPS). I think the probability of abuse is low, but I don't think it is correct solution of authorization. Maybe, I am wrong, and this is my question.

Is this scenario a real problem? Can I classify it as a vulnerability or not?

  • 3
    This token is basically a (temporary) user specific password. You are thus essentially asking if it is a problem that Bob can access the data from Alice, if bob knows the password from Alice. Sure it is, and that's why password and also token should be protected against access by others - which it is in your case. So with proper protection (i.e. Bob does not know Alice token) it is not a vulnerability. Mar 18 at 12:40
  • OAuth2 only specifies, how an access token is retrieved by the application. It does neither specify the form of the token nor how the token is checked at the resource. Basically the token is intended to grant access to some resource. So if you have atoken, you get access to the resource in the context of the user for whom the token was issued. As a result you see what Bob sees when you get your hands on his token.
    – BenjaminH
    Mar 18 at 14:00
  • 1
    Note that http is stateless - this means that the token/session_id/whatever needs to be transferred on every request for the user to have the experience of being "logged id". If you use tokens of another users, you will have experience of being logged in as another user (this is generally true, but to be pedantic: yes, there are also sessions, and local data in cookies etc.).
    – domen
    Mar 18 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.