Subject: [OAUTH-WG] [oauth] #23: Auth Code Swap Attack (CSRF)

From: "oauth issue tracker" <[email-masked]>
Date: Mon, 15 Aug 2011 15:18:03 -0000

#23: Auth Code Swap Attack (CSRF)

 See discussion thread beginning here:
 http://www.ietf.org/mail-archive/web/oauth/current/msg07233.html

 Text proposed by Tony, Yaron, Thorsten, and Phil; proposed text makes
 "state" option required.

 Eran objects and proposes alternative text that does not make "state"
 required.

-- 
-------------------------------------+--------------------------------------
 Reporter:  barryleiba@…             |       Owner:                        
     Type:  defect                   |      Status:  new                   
 Priority:  major                    |   Milestone:  Deliver OAuth 2.0 spec
Component:  v2                       |     Version:                        
 Severity:  In WG Last Call          |    Keywords:                        
-------------------------------------+--------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/oauth/trac/ticket/23>
oauth <http://tools.ietf.org/oauth/>

---

From: "oauth issue tracker" <[email-masked]>
Date: Wed, 24 Aug 2011 15:37:55 -0000

Changes (by barryleiba@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Consensus is to make CSRF prevention a MUST and to recommend the state
 parameter as an implementation mechanism.  Text will go into version -21.

-- 
-------------------------------------+--------------------------------------
 Reporter:  barryleiba@…             |        Owner:                        
     Type:  defect                   |       Status:  closed                
 Priority:  major                    |    Milestone:  Deliver OAuth 2.0 spec
Component:  v2                       |      Version:                        
 Severity:  In WG Last Call          |   Resolution:  fixed                 
 Keywords:                           |  
-------------------------------------+--------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/oauth/trac/ticket/23#comment:1>
oauth <http://tools.ietf.org/oauth/>