Security evaluation of the OAuth 2.0 framework

Abstract

The interoperability of cloud data between web applications and mobile devices has vastly improved over recent years. The popularity of social media, smartphones and cloud based web services have contributed to the level of integration that can be achieved between applications. This paper investigates the potential security issues of OAuth, an authorisation framework for granting third party applications revocable access to user data. OAuth has rapidly become an interim defacto standard for protecting access to web API data. Vendors have implemented OAuth before the open standard was officially published. To evaluate whether the OAuth 2.0 specification is truly ready for industry application, an entire OAuth client server environment was developed and validated against the speciation threat model. The research also included the analysis of the security features of several popular OAuth integrated websites and comparing those to the threat model. High impacting exploits leading to account hijacking were identified with a number of major online publications. It is hypothesised that the OAuth 2.0 specification can be a secure authorisation mechanism when implemented correctly.

Integrated Email Management System Based Google Application Programming Interface Using OAuth 2.0 Authorization Protocol

“…OAuth2. OAuth server works by authenticating and authorizing (Ferry, Raw, & Curran, 2015;Jung & Jung, 2017). If both processes are successful, the client will be given a token code by the OAuth server.…”

Educational Reward Information Communication Api (Eric Api): A Preliminary Study Result

“…OAuth is an open authorization standard that allows users to grant an OAuth client application to access the resource stored in the OAuth server without sharing their credentials (Ferry, Raw, & Curran, 2015). OAuth is one of the popular token-based authentications that allows users to access the applications by logging on their existing accounts such as Facebook, Twitter and Google.…”

A Survey of Security Analysis in Federated Identity Management

“…The papers that we found to have security incidents in this category [11][12][13][14][15][16][17] widely report on a Cross-Site-Request-Forgery (CSRF) attack that capitalises on a weak SP vulnerability. The OAuth specification outlines things the SP must do to resist CSRF attacks, which some SPs do not do.…”

“…The OAuth specification outlines things the SP must do to resist CSRF attacks, which some SPs do not do. In fact, five of the seven OAuth papers analysed reported this vulnerability [11,[13][14][15][16] on the implementations of OAuth. It was found that these security incidents were possible because of the implementations of the protocol themselves rather than fundamental problems with the OAuth protocol.…”

“…It was found that these security incidents were possible because of the implementations of the protocol themselves rather than fundamental problems with the OAuth protocol. All five papers suggested solutions to be implemented by the relevant providers -such as proposals to attempt to bind authorisation requests to browsers -and Ferry et al [13] reported that the CSRF attack had been addressed immediately upon the report.…”