Subject: [OAUTH-WG] Is User Agent Profile Secure in OAuth 2.0?

From: Oleg Gryb <[email-masked]>
Date: Sun, 1 Aug 2010 10:59:54 -0700 (PDT)

I think OAuth 2.0 (http://tools.ietf.org/html/draft-ietf-oauth-v2-10)
User Agent profile is not very secure. Please let me know where/if I'm
wrong.

Let us take a look at step C in Figure 5 :

"Redirect URI with access token in fragment."

It's written everywhere that one should not really put secrets to a
URL. Access token and that URL are all I need to get an access to the
protected resource, right?

Let us assume that somebody copy/pasted that URL from a web server's
access log file or from a Proxy log file and then replayed it 1000
times.

If an action behind the protected resource was to buy a book at
Amazon, does it mean that a victim will be charged for 1000 books?

Also, is there any protection against CSRF or replay attacks in this case?

Thanks,
Oleg.

---

From: Marius Scurtescu <[email-masked]>
Date: Sun, 1 Aug 2010 11:52:22 -0700

> access log file or from a Proxy log file and then replayed it 1000

The fragment is not sent by the browser to the server, so it cannot
end up in log files.

Marius

---

From: Oleg Gryb <[email-masked]>
Date: Sun, 1 Aug 2010 12:14:51 -0700 (PDT)

"Redirect URI" below means HTTP response code 302, right? Will not browser 
follow?

----- Original Message ----
From: Marius Scurtescu <[email-masked]>
To: Oleg Gryb <[email-masked]>
Cc: [email-masked]
Sent: Sun, August 1, 2010 11:52:22 AM
Subject: Re: [OAUTH-WG] Is User Agent Profile Secure in OAuth 2.0?

Marius

---

From: Bouiaw <[email-masked]>
Date: Sun, 1 Aug 2010 21:22:16 +0200

Does the redirect with fragment in URL without sending it to the
server have been tested with all main browsers ?

On Sun, Aug 1, 2010 at 9:14 PM, Oleg Gryb <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Oleg Gryb <[email-masked]>
Date: Sun, 1 Aug 2010 12:47:34 -0700 (PDT)

Let me explain my qs a little bit. It's written in the very beginning of section 
1.4.2: "typically implemented in a browser using a scripting   language such as 
JavaScript".

That phrase, step C and knowledge about how browser redirects are usually 
implemented made me think that:

1. A server sends a redirect to a browser using something like this in response:

HTTP/1.x 301 Moved Permanently 
Location: http://www.google.com? access_token=123

2. When the browser sees the response, it will go to the URI provided in the 
Location header without asking any further questions.

At want point and how are you going to get rid of access token?

----- Original Message ----
From: Marius Scurtescu <[email-masked]>
To: Oleg Gryb <[email-masked]>
Cc: [email-masked]
Sent: Sun, August 1, 2010 11:52:22 AM
Subject: Re: [OAUTH-WG] Is User Agent Profile Secure in OAuth 2.0?

Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Sun, 1 Aug 2010 13:02:17 -0700

> Location: http://www.google.com? access_token=123

The token is in the fragment, not in the query string. The location
would look like:
Location: http://www.google.com#access_token=123

> Location header without asking any further questions.

Based on the above location the browser fetches just:
http://www.google.com

The page that is returned must have JavaScript code that can extract
the fragment (it is still present in the browser address bar) and then
either use it direct (I guess the most common case) or send it back to
the server.

Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Sun, 1 Aug 2010 13:03:36 -0700

> server have been tested with all main browsers ?

AFAIK this is how all major browsers behave. Does anyone know
otherwise? Browsers that don't respect this?

Marius

---

From: Oleg Gryb <[email-masked]>
Date: Sun, 1 Aug 2010 16:18:44 -0700 (PDT)

I'll need to check if it's true for dynamic redirects that use Location header, 
but right now I can provide an example where JavaScripts are used for redirects 
in which case access token is send in a URL.

Let us assume that you've implemented an endpoint on your authz server as a JSP 
that populates access token dynamically:

<html>
<body onload="window.location.href = 
'http://www.google.com#access_token=<%=var_with_token%>'">
</body>
</html>

After JSP container expanded the variable, the response that browser will see 
looks as follows:

<html>
<body onload="window.location.href = 'http://www.google.com#access_token=123'">
</body>
</html>

To test the page above, I put it to my local Apache web server and then accessed 
it using Iceweasel browser. I've used HTTP Live Headers to see all redirects. 
The trace is below. Please let me know what I'm missing. The last GET has access 
token in it.

http://localhost/red.html

GET /red.html HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.7) Gecko/2009032018 
Mozilla/3.0.12 (Debian-3.0.12-1)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
If-Modified-Since: Sun, 01 Aug 2010 23:15:07 GMT
If-None-Match: "dfa53-67-48ccb4133b4c0"-gzip

HTTP/1.x 200 OK
Date: Sun, 01 Aug 2010 23:16:17 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny2 with Suhosin-Patch 
mod_python/3.3.1 Python/2.5.2 mod_perl/2.0.4 Perl/v5.10.0
Last-Modified: Sun, 01 Aug 2010 23:15:07 GMT
Etag: "dfa53-67-48ccb4133b4c0"-gzip
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 110
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
----------------------------------------------------------
http://www.google.com/#access_token=123

GET / HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.7) Gecko/2009032018 
Mozilla/3.0.12 (Debian-3.0.12-1)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/red.html
Cookie: 
PREF=ID=0f1fa5297d3f9d6a:U=f5ef3a217b0cd5bf:TM=1277864220:LM=1278796823:GM=1:S=j8uhrMH9ofdi5YZo;
NID=37=J2gm7WZsItUM0qhpdyYDiOyE7XuO0tWvSWtOcBpgWZ-Y3Rrb6XJC46TcHkHOqiMUF1ClrcG9JZQ9l0BN8eJUinfWIgsUEw7NuCwphBhwjO1odRifOKngacoHcy83E1wd;
; 
SID=DQAAAHcAAADE79x4u_-iBaW7H0MKg1k42z-x8maC4Cm3nUsu68UmsWtkeKZ1cRpG9_YxNhRNeSqGpeRGwyxyMUFtyLBEtfpwt76t_RgE0BTQRig2NqD82bmbcf_CTC0Eu-7HjxNw_n6cW1gkWrUPS46aCzkeIDHAJHDMoVOrrmkVe3lcOGZ1ZQ;
 HSID=ASoUGayYF7At1XErl

----- Original Message ----
From: Marius Scurtescu <[email-masked]>
To: Bouiaw <[email-masked]>
Cc: Oleg Gryb <[email-masked]>; [email-masked]
Sent: Sun, August 1, 2010 1:03:36 PM
Subject: Re: [OAUTH-WG] Is User Agent Profile Secure in OAuth 2.0?

Marius