OAuth Security - TairinySimeonato/WebAuditing GitHub Wiki

OAuth Storage

  • The encryption key that is used to encrypt OAuth tokens, before they are stored in the database, must be stored and backed by a physical HSM module.
  • Some recommendations arE: AWS KMS/Secrets Manager or GCP Cloud HSM.
  • Also, physical HSM (Yubikey has an HSM thats cost effective) also works

Protect Redirect-Based Flow

  • clients should avoid forwarding the user's browser to a page obtained from a URL parameter
  • clients must prevent CSRF
  • Each authorization response should be accepted only once
  • state parameter should be random and unique (acts like a csrf token)
  • client should have least privileges possible within an user's account
  • connection should be over https and end to end TLS
  • 307 redirect
  • Session fixation: A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user. An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
  • watch out for ssrf (https://hackerone.com/reports/398799)

Reports

References

  • topics: oauth tokens security, csrf, redirection, mix up, interception attacks