Questions tagged [confused-deputy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
1answer
629 views

Why do capability-based security systems protect against the confused deputy problem?

According to Wikipedia (https://en.wikipedia.org/wiki/Confused_deputy_problem): In information security, the confused deputy problem is often cited as an example of why capability-based security ...
1
vote
1answer
679 views

Is the OAuth 2 authorization code flow vulnerable to the Confused Deputy Problem?

Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a ...
4
votes
1answer
210 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
11
votes
2answers
8k views

How does setting Origin to null in a redirected CORS request protect against a confused deputy attack?

Excerpt from Here: If a cross-origin resource redirects to another resource at a new origin, the browser will set the value of the Origin header to null after redirecting. This prevents additional ...
1
vote
2answers
952 views

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

Specifically, do I have to worry about the confused deputy problem if I'm just trying to authorize a user against a single API? For example: a basic messaging service will want to authenticate and ...
0
votes
2answers
822 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token (...
2
votes
1answer
1k views

OAuth + Confused Deputy + access token verification + state parameter

Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it ...
35
votes
3answers
35k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
2
votes
1answer
3k views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...