Subject: [OAUTH-WG] Caution about open redirectors using the state parameter

From: Mike Jones <[email-masked]>
Date: Mon, 20 Apr 2020 21:28:47 +0000

I've seen several circumstances where "clever" clients implement an open redirector by encoding a URL to redirect to in the state parameter value.  Attackers can then utilize this open redirector by choosing a state value.

Can we please add an explicit prohibition of this practice in draft-ietf-oauth-security-topics?

                                                       Thanks,
                                                       -- Mike

---

From: George Fletcher <[email-masked]>
Date: Tue, 21 Apr 2020 15:27:57 -0400

+1

However, we should be careful how we prohibit it... because if the state 
value is actually signed, having the URL there isn't a problem as the 
attacker can not manipulate the value without breaking the signature.

On 4/20/20 5:28 PM, Mike Jones wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Neil Madden <[email-masked]>
Date: Tue, 21 Apr 2020 22:35:18 +0100

I think the correct defence is to validate the URL (eg check against a whitelist) at the point you are going to redirect to it after the OAuth flow completes, rather than before you begin the OAuth flow. 

But this feels like generic web app security advice rather than anything specific to OAuth - always validate URLs before performing a redirect.

Neil

> On 21 Apr 2020, at 20:28, George Fletcher <gffletch=[email-masked]> wrote:
> 
>  +1
> 
> However, we should be careful how we prohibit it... because if the state value is actually signed, having the URL there isn't a problem as the attacker can not manipulate the value without breaking the signature.
>

---

From: Pieter Philippaerts <[email-masked]>
Date: Wed, 22 Apr 2020 13:14:34 +0000

> I think the correct defence is to validate the URL

I agree. The URL can be whitelisted, signed, encrypted, ...

> However, we should be careful how we prohibit it...

You could argue that it's already there. Section 4.7.1 says:

If "state" is used for carrying application state, and integrity
of its contents is a concern, clients MUST protect "state" against
tampering and swapping.  This can be achieved by binding the
contents of state to the browser session and/or signed/encrypted
state values [I-D.bradley-oauth-jwt-encoded-state].

Implementations, like the ones you're seeing, where "state" stores a URL and is used without validation do not comply with the above paragraph.

I do agree that the above paragraph is somewhat hidden in the CSRF section. Perhaps a new subsection could be added to section 4 where attacks on the "state" parameter are discussed (and where countermeasures like signing the state are repeated)?

Regards,

Pieter

________________________________
From: OAuth <[email-masked]> on behalf of Neil Madden <[email-masked]>
Sent: Tuesday, April 21, 2020 23:35
To: George Fletcher
Cc: Mike Jones; [email-masked]
Subject: Re: [OAUTH-WG] Caution about open redirectors using the state parameter

Neil

? +1

                                                       Thanks,
                                                       -- Mike

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Daniel Fett <[email-masked]>
Date: Wed, 22 Apr 2020 15:31:25 +0200

> You could argue that it's already there. Section 4.7.1 says:
We also have Section 4.9 on open redirectors:

https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-4.9

-Daniel

---

From: tt tt <[email-masked]>
Date: Wed, 22 Apr 2020 15:16:22 -0700

Could you please delete my email stop sending emails