登录查看更多内容

全部
OAuth

How do you update your OAuth 2.0 clients and servers to follow the latest security best practices?

由人工智能和领英社区提供技术支持

OAuth 2.0 is a widely used protocol for authorizing applications to access protected resources on behalf of users. However, OAuth 2.0 is not a security standard and does not specify how to implement certain security features and best practices. As a result, many OAuth 2.0 clients and servers are vulnerable to common attacks and risks, such as phishing, token leakage, replay, and authorization code injection. To protect your OAuth 2.0 deployments and users, you need to update your clients and servers to follow the latest security best practices. In this article, we will cover six steps to do so.

此文章中的业界达人

由社区从 10 条内容中精选。了解更多

Jоsé P. Alоnza

---

1 Use PKCE for public clients

Public clients are applications that cannot keep their client secrets confidential, such as mobile apps, browser-based apps, and desktop apps. These clients are susceptible to authorization code interception attacks, where an attacker can steal the authorization code and exchange it for an access token. To prevent this, you should use the Proof Key for Code Exchange (PKCE) extension, which requires the client to generate a random code verifier and a derived code challenge, and send them along with the authorization request and the token request. This way, the server can verify that the same client initiated and completed the flow.

添加您的观点

Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Integrating Proof Key for Code Exchange (PKCE) became essential with the increasing use of mobile and single-page applications. PKCE adds an extra layer of security by requiring a code challenge and verifier for each authentication request, significantly reducing the risk of interception attacks. Implementing PKCE was a learning curve but noticeably enhanced the security of our OAuth 2.0 flows, making it a standard practice for all public clients.

已翻译

赞

2 Use HTTPS for all endpoints

All OAuth 2.0 endpoints, including the authorization endpoint, the token endpoint, and the redirection endpoint, should use HTTPS to ensure secure communication and prevent man-in-the-middle attacks. HTTPS encrypts the data transmitted between the client and the server, and validates the identity of the server using certificates. If you use plain HTTP, you risk exposing your client credentials, authorization codes, access tokens, and refresh tokens to attackers who can intercept or modify the traffic.

添加您的观点

Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Transitioning to HTTPS for all OAuth endpoints was a critical move towards securing our authentication and authorization processes. This ensured that all data exchanged between clients, servers, and users was encrypted, protecting against eavesdropping and man-in-the-middle attacks. While initially daunting, the switch to HTTPS was facilitated by modern tools and services, making it a seamless yet impactful upgrade in our security measures.

已翻译

赞

3 Validate redirect URIs

The redirect URI is the endpoint where the client receives the authorization code or the access token from the server after the user grants consent. The server should only accept redirect URIs that are registered by the client and match exactly with the ones sent in the authorization request. This prevents open redirector attacks, where an attacker can trick the user into visiting a malicious site that impersonates the legitimate client and steals the authorization code or the access token.

添加您的观点

Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Redirect URI validation was tightened to prevent unauthorized redirection and potential leakage of authorization codes or tokens. By strictly validating redirect URIs against a predetermined whitelist, we mitigated risks associated with open redirection attacks. This measure required diligent configuration and maintenance of redirect URIs but proved crucial in safeguarding our OAuth flows.

已翻译

赞

4 Use short-lived and scoped access tokens

Access tokens are the credentials that the client uses to access the protected resources on behalf of the user. To minimize the impact of token leakage or theft, you should use short-lived and scoped access tokens. Short-lived access tokens expire after a short period of time, forcing the client to renew them with a refresh token or a new authorization request. Scoped access tokens limit the permissions and actions that the client can perform on the resource server, reducing the potential damage in case of unauthorized access.

添加您的观点

Jоsé P. Alоnza

---
举报内容
Es correcto, implementar la renovación automática de tokens para evitar la necesidad de almacenar tokens de acceso a largo plazo en el cliente. De esta manera, se reducen los riesgos asociados con el almacenamiento prolongado de tokens entonces es importante tambien entonces, establecer politicas de expiración, configurandolas de forma adecuada para los tokens en el cliente, asegurándonos de que lso tokens se actualicen o se eliminen cuando sea necesario.

已翻译

赞
Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Adopting short-lived access tokens with specific scopes significantly reduced the impact of potential token leaks. By limiting the lifespan and access scope of each token, the window for exploitation by unauthorized parties was greatly narrowed. Implementing token expiration and scope management added complexity to our token service but greatly improved our overall security stance.

已翻译

赞

5 Store and transmit tokens securely

Tokens are sensitive data that should be stored and transmitted securely by the client and the server. You should avoid storing tokens in insecure locations, such as browser storage, cookies, or logs, where they can be accessed by other parties or scripts. You should also avoid transmitting tokens in insecure channels, such as query parameters, where they can be exposed in the URL or the browser history. Instead, you should store tokens in encrypted or protected storage, such as secure cookies or keychain, and transmit them in secure channels, such as HTTP headers or POST bodies.

添加您的观点

Jоsé P. Alоnza

---
举报内容
El almacenamiento seguro de tokens es una de las practicas recomendadas que se pueden seguir. El almacenamiento seguro a nivel de sistema operativo del dispositivo cliente, por ejemplo: - Dispositivos móviles: en telefonos inteligentes, se pueden utilizar mecanismos seguros de almacenamiento como el keystore en Android o el Secure Enclave en iOS para almacenar claves y tokens de forma segura. - Navegadores Web: los navegadores aprovechan las capacidades de almacenamiento seguro, como sessionstorage o localstorage, entonces es bueno asegurarse de que se esten utilizando adecuadamente.

已翻译

赞
Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Ensuring the secure storage and transmission of tokens involved adopting best practices such as using secure, encrypted channels for transmission (HTTPS) and employing secure storage mechanisms on the client side. This also meant educating our team and users on the importance of token security, from secure transmission to vigilant storage practices.

已翻译

赞

6 Implement token revocation and introspection

Token revocation and introspection are optional features that allow the client and the server to invalidate and verify tokens respectively. Token revocation enables the client or the server to revoke an access token or a refresh token when it is no longer needed or compromised, preventing further usage. Token introspection enables the server to check the validity and metadata of a token, such as its expiration time, scope, and issuer, before granting access to a resource. These features enhance the security and control of the OAuth 2.0 flow and can be implemented using standard or custom endpoints.

添加您的观点

Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Implementing mechanisms for token revocation and introspection added a layer of control and visibility over token usage. In case of suspected compromise or the end of a token's intended use, having the ability to revoke access immediately was invaluable. Similarly, token introspection allowed our systems to verify the active status and scope of tokens, enhancing real-time security checks.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Jоsé P. Alоnza

---
举报内容
A nivel de clientes OAuth 2.0, me parece importante considerar el uso del Flujo de Autorización mas Seguro, por ejemplo Authorization Code Flow para aplicaciones web y Mobile Device Authorization Flow para aplicaciones moviles.

已翻译

赞
Arun Prasath

Fractional CTO | AI Engineer | Building AI Agents | Gaming | Love anything remote | 18+ Years of Software development experience
举报内容
Beyond these measures, staying informed about the latest developments in OAuth 2.0 security and related technologies has been paramount. Regularly reviewing and updating our practices in line with industry standards and guidelines ensures our systems remain secure. Additionally, fostering a culture of security awareness among developers and users alike has been crucial for maintaining a proactive stance on OAuth security.

已翻译

赞

OAuth

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you update your OAuth 2.0 clients and servers to follow the latest security best practices?

1

2

3

4

5

6

7

1 Use PKCE for public clients

2 Use HTTPS for all endpoints

3 Validate redirect URIs

4 Use short-lived and scoped access tokens

5 Store and transmit tokens securely

6 Implement token revocation and introspection

7 Here’s what else to consider

OAuth

给文章评分

感谢您的反馈

更多OAuth相关文章

更多相关阅读内容