Subject: [OAUTH-WG] Security Considerations - Access Tokens

From: Marco De Nadai <[email-masked]>
Date: Sun, 30 Oct 2011 17:44:06 +0100

Hi all,

i've recently noticed that in OAuth 2.0 draft 22, in the section 10.3 there
is this statment:

Access token (as well as any access token type-specific attributes) MUST be
kept confidential in transit and storage, and only shared among the
authorization server, the resource servers the access token is valid for,
and the client to whom the access token is issued.

BUT in OAuth 2.0 draft 22 with Authorization Code and MAC Access
Authentication, I can request a resource with Access Token sent in clear.
This invalidates the "Access token (as well as any access token
type-specific attributes) MUST be kept confidential in transit and storage".

Is it my error?

-- 
*Marco De Nadai*
http://www.marcodena.it/<http://www.marcodena.it/?utm_source=email&utm_medium=email&utm_campaign=Email%2Bpersonali>

---

From: Dan Taflin <[email-masked]>
Date: Mon, 31 Oct 2011 15:54:24 +0000

To be consistent, section 10.3 should probably specify that the requirement of confidentiality in transit applies specifically to BEARER tokens.

I would like to see this relaxed further though, as I argued last week, to accommodate situations where a token is scoped to a limited set of data that isn't particularly sensitive. My example was image search. It seems too restrictive to require TLS for an operation that does nothing more than what anyone could do by pointing a browser at our web site. Http cookies can be specified as either requiring or not requiring secure transport; it seems reasonable to allow the same option for bearer tokens, which fulfill an analogous role.

Dan

From: Marco De Nadai [mailto:[email-masked]]
Sent: Sunday, October 30, 2011 9:44 AM
To: [email-masked]
Subject: [OAUTH-WG] Security Considerations - Access Tokens

Hi all,

i've recently noticed that in OAuth 2.0 draft 22, in the section 10.3 there is this statment:

Access token (as well as any access token type-specific attributes) MUST be kept confidential in transit and storage, and only shared among the authorization server, the resource servers the access token is valid for, and the client to whom the access token is issued.

BUT in OAuth 2.0 draft 22 with Authorization Code and MAC Access Authentication, I can request a resource with Access Token sent in clear. This invalidates the "Access token (as well as any access token type-specific attributes) MUST be kept confidential in transit and storage".

Is it my error?

--
Marco De Nadai

---

From: Marco De Nadai <[email-masked]>
Date: Mon, 31 Oct 2011 17:03:58 +0100

I think it's wrong to specify in the OAuth GENERAL security consideration,
a consideration only for a specific type of token.

2011/10/31 Dan Taflin <[email-masked]>

>  To be consistent, section 10.3 should probably specify that the
> requirement of confidentiality in transit applies specifically to BEARER
> tokens.****
>
> ** **
>
> I would like to see this relaxed further though, as I argued last week, to
> accommodate situations where a token is scoped to a limited set of data
> that isn’t particularly sensitive. My example was image search. It seems
> too restrictive to require TLS for an operation that does nothing more than
> what anyone could do by pointing a browser at our web site. Http cookies
> can be specified as either requiring or not requiring secure transport; it
> seems reasonable to allow the same option for bearer tokens, which fulfill
> an analogous role.****
>
> ** **
>
> Dan****
>
> ** **
>
> *From:* Marco De Nadai [mailto:[email-masked]]
> *Sent:* Sunday, October 30, 2011 9:44 AM
> *To:* [email-masked]
> *Subject:* [OAUTH-WG] Security Considerations - Access Tokens****
>
> ** **
>
> Hi all,****
>
> ** **
>
> i've recently noticed that in OAuth 2.0 draft 22, in the section 10.3
> there is this statment: ****
>
> ** **
>
> Access token (as well as any access token type-specific attributes) MUST
> be kept confidential in transit and storage, and only shared among the
> and the client to whom the access token is issued.****
>
> ** **
>
> ****
> ** **
> Is it my error?****
> ** **
> -- ****
> *Marco De Nadai*****
> ****
> ** **

---

From: William Mills <[email-masked]>
Date: Mon, 31 Oct 2011 09:33:12 -0700 (PDT)

Yeah, there's a punt here...  I believe it's recognizing that people will in fact use bearer tokens on a plaintext channel, the slight mitigation being shorter lifespan of the token.  

________________________________
From: Dan Taflin <[email-masked]>
To: Marco De Nadai <[email-masked]>; "[email-masked]" <[email-masked]>
Sent: Monday, October 31, 2011 8:54 AM
Subject: Re: [OAUTH-WG] Security Considerations - Access Tokens

 
I would like to see this relaxed further though, as I argued last week, to accommodate situations where a token is scoped to a limited set of data that isn’t particularly sensitive. My example was image search. It seems too restrictive to require TLS for an operation that does nothing more than what anyone could do by pointing a browser at our web site. Http cookies can be specified as either requiring or not requiring secure transport; it seems reasonable to allow the same option for bearer tokens, which fulfill an analogous role.
 
Dan
 
From:Marco De Nadai [mailto:[email-masked]] 
Sent: Sunday, October 30, 2011 9:44 AM
To: [email-masked]
Subject: [OAUTH-WG] Security Considerations - Access Tokens
 
Hi all,

 
 
Is it my error?
 
-- 
Marco De Nadai
http://www.marcodena.it/?utm_source=email&utm_medium=email&utm_campaign=Email%2Bpersonali
 
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Marco De Nadai <[email-masked]>
Date: Mon, 31 Oct 2011 17:38:29 +0100

It's a OAuth2-Bearer security consideration not OAuth generally

2011/10/31 William Mills <[email-masked]>

> Yeah, there's a punt here...  I believe it's recognizing that people will
> in fact use bearer tokens on a plaintext channel, the slight mitigation
> being shorter lifespan of the token.
>
> ------------------------------
> *From:* Dan Taflin <[email-masked]>
> *To:* Marco De Nadai <[email-masked]>; "[email-masked]" <
> [email-masked]>
> *Sent:* Monday, October 31, 2011 8:54 AM
> *Subject:* Re: [OAUTH-WG] Security Considerations - Access Tokens
>
> tokens.
> an analogous role.
> *Subject:* [OAUTH-WG] Security Considerations - Access Tokens
>
> Hi all,
>
> there is this statment: