Repository navigation
Malicious Endpoint Attack #78
Description
Activity
Originally submitted by dgtonge (Dave Tonge) on 2017-03-23
This is an interesting attack. But isn't it outside the scope of FAPI?
Currently I don't believe the client registration phase is mentioned in the fapi spec.Originally submitted by Nat (Nat Sakimura) on 2017-04-04
As long as we use request object and hybrid mode, we are protected.
The question is whether we require them?
probably yes.
Originally submitted by dgtonge (Dave Tonge) on 2017-04-26
It would be good in an intro or summary to refer to the attacks which we protect against by requiring hybrid flow and request object.
Originally submitted by Nat (Nat Sakimura) on 2017-04-26
Add brief description in the intro, and details in the security considerations in Part 2.
Originally submitted by Nat (Nat Sakimura) on 2017-05-13
Hmmm. I want to make sure that it is a valid attack.
I am now confused how does it get the client secret?It can certainly get the
codebut that is pretty much it, is it not?Originally submitted by Nat (Nat Sakimura) on 2017-05-28
-> <>
This is an attack listed in the report SoK: Single Sign-On Security – An Evaluation of OpenID Connect.
In this test, the Attacker OP returns maliciously crafted Discovery document and afterward to create an ID Token containing the identity of the victim, which is controlled by another OP – Honest OP.
Prerequisite
Execution
The Attacker OP returns the following configuration during the Discovery phase.
Result Evaluation
The goal of this test is to verify whether the End-User authentication can be broken. The attack is successful if the Attacker OP receives any secret information, for example, client_id, client_secret, code or access token, generated by the Honest OP.
Bitbucket status: closed
Bitbucket origin: issue 78