CODEWITHSUNDEEP
securityoauthhttpsoauth-2.0ssl
Stéphan Kochen
Stéphan Kochen

Reputation: 19943

Does an OAuth 2 client really need TLS?

I intend to build a delegated login system for an existing app. I'll be implementing both the OAuth client (in a web application) and the OAuth server (a simple authorization and resource server, that really only has a 'user' resource for now.)

With that in mind, I came across the following section in the current OAuth 2 draft (version 22):

3.1.2.1.  Endpoint Request Confidentiality

   If a redirection request will result in the transmission of an
   authorization code or access token over an open network (between the
   resource owner's user-agent and the client), the client SHOULD
   require the use of a transport-layer security mechanism.

   Lack of transport-layer security can have a severe impact on the
   security of the client and the protected resources it is authorized
   to access.  The use of transport-layer security is particularly
   critical when the authorization process is used as a form of
   delegated end-user authentication by the client (e.g. third-party
   sign-in service).

This specifically warns me that I should be using TLS on the client. We will be using HTTPS on the server, of course, but enabling HTTPS on all clients will be difficult if not impossible.

From my limited understanding of security, I imagine someone could steal the authorization grant. This brings me to my question:

Won't client authentication (using the client secret) prevent an eavesdropper from using the authorization grant? (Because the malicious party won't know the client secret, hopefully.)

If it doesn't, or if there's another attack vector here I'm not seeing, is there anything I can do to make this work securely without HTTPS on the clients? Would, for example, OAuth 1 help? (Perhaps because it has the additional request token step.)

P.S.: I was planning on doing client authentication using TLS client certificates, rather than secrets, if that makes the situation any better.

Upvotes: 2

Views: 5605

Answers (1)

rook
rook

Reputation: 67019

I think you are misinterpreting part of this warning. This OAuth warning is addressing OWASP A9 violations. This is saying that even though you are using OAuth you still need a secure transport layer to communicate with the client. The client doesn't require a key pair for authentication, OAuth is the client's form of authentication. However, the browser still authenticates with your application using a session id stored as a cookie value. The concern is that if an attacker is able to intercept this value, then he will have the same access as the victimized client.

Upvotes: 2

Related Questions