Questions tagged [confused-deputy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
1answer
368 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
1
vote
1answer
499 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
4
votes
1answer
94 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
8
votes
2answers
3k views

How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?

Excerpt from Here: If a cross-origin resource redirects to another resource at a new origin, the browser will set the value of the Origin header to null after redirecting. This prevents additional ...
1
vote
2answers
697 views

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API? For example: a basic messaging service will want to authenticate and ...
0
votes
2answers
735 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token (...
2
votes
1answer
843 views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
28
votes
3answers
30k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
2
votes
1answer
2k views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...