CODEWITHSUNDEEP
oauthclientidphishing
Stanislav Berkov
Stanislav Berkov

Reputation: 6287

OAuth client id and guessing

OAuth manual https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/ says that

The client_id is a public identifier for apps. Even though it’s public, it’s best that it isn’t guessable by third parties, so many implementations use something like a 32-character hex string. It must also be unique across all clients that the authorization server handles. If the client ID is guessable, it makes it slightly easier to craft phishing attacks against arbitrary applications.

Why should I care about client-id guessing? It is public. Anyone can read it. Why should I make it hex string?

Can I have own oauth provider that has only few client ids, e.g. app1, app2, app3. I will use PKCE and server redirect to well known urls only.

How that is vulnerable to phishing having such short client-id values?

Upvotes: 2

Views: 427

Answers (0)

Related Questions