0

I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow.

Assuming that site A uses the implicit flow for authentication, it will redirect the user to Facebook for login, wait for an authentication token to return, and use that token to query for the user's information (e.g Email) and then log the user in.

What stops a malicious user to use a proxy and modify the last part of the interaction? When site A queries for the user's information, the user can simply change the response from [email protected] to [email protected] . Simply by modifying the response, we've got an account takeover.

5
  • TLS would stop that sort of thing, yes?
    – schroeder
    Nov 13, 2023 at 16:30
  • 1
    No, since you proxy the request... you can have a valid TLS on ProxyA.com and A.com and still try this attack. there are other things that prevent it, mainly on the server side... its also a obsolete mechanism. partly due to the risks involved.
    – LvB
    Nov 13, 2023 at 16:32
  • 1
    I couldn't follow what you said. TLS is not an issue because after installing a root certificate, the TLS can be re-encrypted. Nov 13, 2023 at 16:45
  • @TrigosinDarom: "TLS is not an issue because after installing a root certificate, the TLS can be re-encrypted." - this would require either explicit collaboration of the end user to install this root certificate or a compromised end user device where the attacker can install this root certificate as trusted. But, if the end user device is compromised than what you describe is just one of many problems the end user has. Nov 13, 2023 at 20:48
  • 1
    I'm not sure you followed the attack correctly. Implicit flow happens solely in the end user browser. If the flow is used for authentication, that means that in the end of the flow, a token will be exchanged for user information (like an Email). This attack depicts a malicious user that want to take over an account. Nov 14, 2023 at 9:37

1 Answer 1

1

First of all, the implicit flow is deprecated. it should not be used. (it has been replaced with the PKCE flow)

The way the implicit flow works is by matching a known URI, source and client Identifier. and only when all 3 pass, send a Acces-token back. no Id-Token is used and typically the client is treated as little more than a "slightly" more trusted unauthorized user.

typically the Access-Token is a JWT which is signed... meaning you can not alter it without invalidating it.

this also means that by proxying the request, at best you can see & do what the user can see & do. you cant use it to impersonate another.

For more insights into how this works, you can read the excellent blog posts from Aaron Parecki

6
  • The access token is used by the application to query for the user information. I can definitely alter the response of the user information. Nov 13, 2023 at 16:47
  • OAuth has no user information, that would be OpenID connect. and how could you adjust any information in relation to the OAuth proces when the tokens are signed? your token gives you only acces to UserInfoA, you cant manipulate it to give acces to UserInfoB without having acces to the Key.
    – LvB
    Nov 13, 2023 at 17:03
  • Websites sometimes use OAuth (not OIDC) for authentication. They use the email address of the user for login. That means that if UserInfoA is myuser@domain, I can modify it to "admin@domain". I can do that because that data is going through my browser. Nov 14, 2023 at 9:34
  • OAuth is a AUTHORIZITION protocol, not a AUTHENTICATION protocol.. if you add Authentication... than that's a custom implementation and out of scope... in any case, if they use the JWT tokens for it (as they should) you get the same protection... if not... than the token would not identify any user but just identify a given access. which you still cant exploit to more access...
    – LvB
    Nov 14, 2023 at 12:50
  • I'm well aware that OAuth is an authorization protocol, but still it is sometimes used for authentication. That doesn't mean it should automatically allow account takeover. After getting a token, the website uses the token to retrieve user information from the IDP. If the user information is not signed (JWT), this information can be altered using a proxy and affect the information that will be used by the website. Nov 14, 2023 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .