Subject: [oauth] OAuth session fixation attack countermeasures

From: "Floyd, Nicholas" <[email-masked]>
Date: Wed, 29 Apr 2009 21:24:30 -0500

Eran:

We have implemented the recommended wording from the security advisory.  We have also come up with another measure after discussions with you and some internal collaboration.

1.       Consumer requests an unauthorized request token --> The service provider stores the generated token with the consumers domain (obtained from the request)

2.       Consumer requests authorization from the user --> The service provider verifies the consumers request domain with the domain stored with the token

3.       The Consumer requests an Access token using the authorized request token --> The service provider verifies the consumers request domain with the domain stored with the token

Given:
PASS

1.       Consumer Host: www.myconsumersite.com<http://www.myconsumersite.com> - Request an unauthorized request token

2.       Service provider verifies and grants unauthorized request token storing "myconsumersite" with the token

3.       Consumer Host: www.myconsumersite.com<http://www.myconsumersite.com> - authorization from the user

4.       Service provider verifies token and domain: "myconsumersite"

5.       User logs in and allows access

6.       Service provider sends back the authorized request token

7.       Consumer Host: www.myconsumersite.com<http://www.myconsumersite.com> - Request an access token using the authorized request token

8.       Service provider verifies token and domain: "myconsumersite" and passes back an access token

FAIL

1.       Consumer Host: www.myconsumersite.com<http://www.myconsumersite.com> - Request an unauthorized request token

2.       Service provider verifies and grants unauthorized request token storing "myconsumersite" with the token

3.       Consumer Host: www.notmyconsumersite.com<http://www.notmyconsumersite.com> - authorization from the user

4.       Service provider verifies token and domain: "notmyconsumersite"  with the domain from the token "myconsumersite"

5.       Service provider rejects the request and passes back a 400 or 403

The last two legs of OAuth the Service provider will verify the originating domain and reject the request if the domain or ip do not match what is stored with the request token.

We know this binds the consumer to have the end to end OAuth implementation exist on one domain, however, we feel that this would be an effective way to stop the fixation attack.

Any feedback or thoughts on this approach would be appreciated.

Nick Floyd - Integration Architect
Fellowship Technologies<http://www.fellowshiptech.com/>
Twitter : @nickfloyd
[email-masked]<mailto:[email-masked]>
Col 3:23