Subject: Re: [OAUTH-WG] Recommended OpenId Connect Flow for SPA with Microservices

From: David Waite <[email-masked]>
Date: Thu, 4 Jul 2019 18:32:50 -0700

> On Jul 3, 2019, at 1:44 AM, [email-masked] wrote:

<snip>

> I understood, that you could also secure this variant of the Authorization Code Flow with PKCE in order to protect the redirect steps. I noticed, that this is rarely discussed "in public" (e.g. blogs, Stackoverflow etc) because some people say PKCE is considered to only be beneficial in native applications. I know it was invented for protecting the IPC steps of those, but why isn't it beneficial to also protect the browser redirect steps?

The PKCE guidance is slowly changing. Previously, PKCE was used mostly for native apps as the code could be intercepted in between the front channel and back channel calls. This is because operating systems do not restrict registration of a custom URI scheme to a single application, so the redirect back into the application (with the code) could actually go to another app.

The security-topics draft (and browser apps draft which refers to it) expands this to all code flow. The reasoning is that this replaces some of the security mitigations pushed onto the state parameter (such as to prevent CSRF) - PKCE is both a more obvious place for it, and a client which does not support PKCE correctly is detectable by the AS.

-DW

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 22 Jul 2019 14:30:41 +0200

Hi David, 

> On 12. Jun 2019, at 04:01, David Waite <[email-masked]> wrote:
> 
> To prevent exfiltration, the options are limited. 
> - Token Binding will work, but only currently has support in Edge.
> - Mutual TLS will work, but has a poor experience unless you are deploying alongside group policy.
> - DPoP was written specifically for the browser use case (such as letting you use WebCrypto for non-exportable tokens). It is an early draft but has some initial implementations already.

If you use a backend to relay or orchestrate your micro service interactions, mTLS (with self-signed certs) is the easiest choice from my perspective. 

kind regards,
Torsten.

---

From: David Sautter <[email-masked]>
Date: Mon, 22 Jul 2019 15:54:51 +0200

Hi Thorsten,

do you mean that for service2service communication or for the frontend to backend communication?

How would that process look like in a nutshell?

Thanks!
David

Am 22. Juli 2019 14:30:41 MESZ schrieb Torsten Lodderstedt <[email-masked]>:
>> - DPoP was written specifically for the browser use case (such as
>letting you use WebCrypto for non-exportable tokens). It is an early
>draft but has some initial implementations already.
>
>If you use a backend to relay or orchestrate your micro service
>interactions, mTLS (with self-signed certs) is the easiest choice from
>my perspective. 
>
>kind regards,
>Torsten. 

-- 
Diese Nachricht wurde von meinem Android-Gerät mit K-9 Mail gesendet.