Subject: [OAUTH-WG] FYI: security analysis of double-redirection protocols, including OAuth 2.0

From: Francisco Corella <[email-masked]>
Date: Tue, 8 Feb 2011 23:51:59 -0800 (PST)

Hi,

We've written a technical report that has a security analysis of double-redirection protocols such as OpenID and OAuth.  Section 3.5 discusses OAuth 2.0.  Most of section 4 may also be of interest to this list.  You can find the report at
http://www.pomcor.com/techreports/DoubleRedirection.pdf.
I hope it's useful!

Thanks in advance for any comments.

Francisco