20130914_pdf_pub_OAuth-2.0_security_case_review.pdf

《20130914_pdf_pub_OAuth-2.0_security_case_review.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、OAuth2.0安全案例回顾HorseLuke版本改动记录Ver0.0.1/2013-09-13初版，发表于乌云知识库：http://drops.wooyun.org/papers/598发表时有改动分段方法Ver0.0.1/2013-09-14初版，根据原版调整成PDF主要是分页和排版1/34目录一、背景................................................................................................

2、...................................................................................3二、OAuth2.0的安全焦点......................................................................................................................................................4

3、（1）尽量适应多个场景授权：场景复杂化下增加了攻击点.....................................................................................4（A）AuthorizationCodeGrant（授权code许可）..............................................................................................5（B）Impli

4、citGrant（隐式许可）...........................................................................................................................7（C）ResourceOwnerPasswordCredentialsGrant（资源所有者密码凭据许可；XAuth即为此类）...............9（2）简化和不作强制要求：落空的开发者保安全愿望.........

5、..................................................................................10三、攻陷应用方的账号体系.................................................................................................................................................113.1、当授权

6、用于认证时的不当参数选择或无验证机制............................................................................................113.2、针对应用方csrf劫持第三方账号......................................................................................................................

7、..133.3、更猥琐的针对应用方csrf劫持第三方账号：应用方授权动作本身的csrf+平台方的登录漏洞…..............153.4、账号体系的固有逻辑缺陷利用............................................................................................................................19四、攻击平台方的账号和资源体系.......................

8、..............................................................................................................214.1、ImplicitGrant场景的无奈（response_type=token）..........................................................................................214.1