Walks

网络安全爱好者

浅谈OAuth2.0协议安全性

前言:

老洞新谈,重复造属于自己的轮子。

 

目录:

0x01:什么是OAuth2.0协议

0x02:配置不当所造成的危害

0x03:如何正确配置


什么是OAuth2.0协议

     在OAuth协议还没有产生之前,如何我们想要登录一个网站,而这个网站又支持第三方登录,例如QQ登录。那么我们就只能在这个网站上输入QQ账号和密码,这个网站同时也就知道了我们的账号和密码,这势必会产生一些安全问题,而OAuth协议就是为了解决这些安全问题而产生的,Oauth2.0是Oauth协议的升级版。总的来说,OAuth2.0就是客户端和认证服务器之间由于相互不信任而产生的一个授权协议。

    本篇文章不过多说OAuth协议的原理等,贴个原理地址,Oauth原理

    

    协议四种模式:

    授权码模式(authorization code)

    简化模式(implicit)

    密码模式(resource owner password credentials)

    客户端模式(client credentials)

    

    安全性我们主要关注四个参数。

    redirect_url:回调域名

    client:必须与域名绑定

    state:防止CSRF

    scope:权限范围


    配置不当所产生的危害

  •     CSRF

   漏洞产生原因在于State参数未添加或者未起作用。

    复现步骤:

    1:第三方网站请求登录客户端。

    2:输入QQ账号密码。302跳转,https://XXX.com/back/qq?code=35072F11AEE413B87553B32F6168B5DA&state=TCHmIyWrvP。

    3:删去state参数,把请求发给受害者。

    4:受害者点击后,登录我的账号。

  •     Scope越权

    例如URL里的原本参数是这样的。Scope:read。我截取这个请求然后修改一下为Scope:write。如果我们可以修改文件,就说把原本可读的权限越权修改成了可写的权限。

  •     Redirect参数未严格限制

    这里以QQ的OAuth2.0接口为例,假如地址是这样的:https://graph.qq.com/oauth2.0/show?client_id=10086&redirect_uri=https://XXX/back/qq&state=TCHmIyWrvP

    当我们登录成功后,会把code和state拼接到redirect_uri之后,如果这个redirect_uri可以是任何值,那么我们的code是不是就遭到了泄露?但是这里的client_id就破灭了你的这个想法,服务器会验证client_id是否和redirect_uri规定的域一致,如果不一致则无法登陆。这里就又有了个新的攻击手法,如何在redirect_uri规定的域中有一个open redirect,我们就可以从referer中看到token,达到一样的攻击效果。

    下面来一点Open Redirect Bypass:

///www.bywalks.com/%2f%2e%2e
///www.bywalks.com/%2f%2e%2e/
/https:/%5cbywalks.com/
//www.bywalks.com/%2f%2e%2e
//www.bywalks.com
/www.bywalks.com
https://www.google.com/www.bywalks.com
/%2Fbywalks%252Ecom
http://www.google.com\.bywalks.com
http://www.google.com\@bywalks.com
http://www.google.com\#bywalks.com
http://www.google.com\?bywalks.com
http://www.google.com\\bywalks.com
http://www.google.com\bywalks.com


    如何修复

  1:做好Scope的权限验证。

  2:state参数一次验证后失效。

  3:redirect_uri严格控制。

点赞
  1. I have to express appreciation to you for rescuing me from this particular scenario. Because of surfing around through the the web and coming across notions which were not powerful, I believed my entire life was well over. Living devoid of the solutions to the difficulties you've fixed all through your short post is a crucial case, as well as those that might have badly damaged my career if I hadn't discovered your blog post. That competence and kindness in controlling every item was excellent. I'm not sure what I would've done if I had not discovered such a step like this. I'm able to at this moment look forward to my future. Thank you very much for your skilled and results-oriented guide. I will not hesitate to suggest your web site to any person who needs tips about this problem.

  2. I happen to be commenting to let you know of the beneficial discovery our daughter undergone reading through your blog. She discovered plenty of details, not to mention what it's like to possess an amazing helping heart to get men and women really easily thoroughly grasp certain very confusing subject matter. You actually exceeded our expected results. Thank you for coming up with such interesting, dependable, revealing not to mention unique tips about the topic to Kate.

  3. longchamp outlet说道:

    I want to show appreciation to the writer for rescuing me from this circumstance. As a result of surfing around throughout the internet and seeing views that were not helpful, I figured my life was well over. Being alive without the approaches to the difficulties you've sorted out through this guide is a serious case, and those that could have badly affected my career if I hadn't discovered the blog. Your own personal know-how and kindness in maneuvering all the stuff was valuable. I don't know what I would've done if I had not come across such a point like this. I can also at this moment relish my future. Thanks very much for this skilled and results-oriented help. I won't hesitate to endorse your web page to any individual who would need support on this topic.

  4. My wife and i felt excited when Emmanuel could carry out his survey through the entire precious recommendations he grabbed through the web page. It is now and again perplexing to just happen to be making a gift of points which often men and women could have been making money from. We really already know we have got the website owner to give thanks to for that. The specific explanations you've made, the simple web site navigation, the relationships your site give support to foster - it's got mostly amazing, and it's helping our son and us reckon that the topic is exciting, which is highly serious. Thank you for the whole lot!

  5. jordan retro 12说道:

    My wife and i ended up being really thrilled that Michael could finish up his basic research through the precious recommendations he was given when using the blog. It is now and again perplexing just to continually be offering procedures which other people might have been trying to sell. And we also consider we have you to give thanks to because of that. Those illustrations you've made, the straightforward site navigation, the friendships you will give support to promote - it's many amazing, and it's assisting our son and us recognize that the article is enjoyable, which is unbelievably serious. Thanks for all!

  6. cheap jordans说道:

    I'm also commenting to let you understand of the extraordinary experience my princess enjoyed reading yuor web blog. She even learned a lot of pieces, including what it is like to have a wonderful teaching style to make certain people without problems learn chosen tricky topics. You truly exceeded our own expected results. Many thanks for churning out the priceless, dependable, explanatory and also fun thoughts on this topic to Julie.

  7. goyard wallet说道:

    I and also my pals have been digesting the excellent hints on your web blog and so unexpectedly came up with an awful feeling I never thanked the web blog owner for them. My young boys appeared to be as a consequence very interested to learn all of them and have in effect really been loving them. We appreciate you genuinely so considerate and then for making a decision on variety of essential things millions of individuals are really needing to be informed on. My honest regret for not expressing appreciation to you sooner.

  8. I needed to compose you the little bit of note to say thanks a lot over again on the awesome tricks you have discussed above. It's seriously generous with people like you to provide easily precisely what most people could have offered for sale as an electronic book to help make some money for themselves, most importantly now that you could have tried it if you decided. Those good ideas as well served to provide a fantastic way to be certain that other people have a similar dream similar to my own to figure out a whole lot more pertaining to this matter. I am sure there are lots of more fun occasions in the future for individuals that examine your site.

  9. yeezy shoes说道:

    I would like to show my appreciation for your generosity giving support to those people who really need help on in this idea. Your real commitment to passing the solution up and down appears to be extraordinarily practical and have all the time enabled guys and women like me to get to their endeavors. Your own warm and helpful guidelines means a great deal to me and far more to my fellow workers. With thanks; from each one of us.

  10. I wanted to draft you that very little observation to help thank you very much as before for all the spectacular principles you've discussed at this time. It has been really strangely open-handed with people like you to provide unhampered just what many people would've marketed for an e book to help with making some money for their own end, and in particular now that you might well have tried it if you decided. Those strategies additionally acted like the fantastic way to realize that many people have the same eagerness just as mine to grasp more concerning this condition. I'm sure there are several more pleasurable situations in the future for individuals that read your website.

  11. I wish to convey my respect for your generosity giving support to those individuals that should have guidance on this particular subject matter. Your special commitment to passing the solution up and down came to be astonishingly powerful and has regularly encouraged workers like me to attain their desired goals. Your amazing invaluable help and advice entails this much to me and much more to my colleagues. Thanks a lot; from all of us.

  12. nike cortez men说道:

    I'm also commenting to let you be aware of what a magnificent experience my child found reading through your web site. She realized a lot of pieces, which include how it is like to possess a marvelous coaching nature to let certain people quite simply gain knowledge of certain grueling subject areas. You truly surpassed our own expected results. I appreciate you for presenting such helpful, dependable, explanatory as well as easy tips on the topic to Julie.

  13. I wish to convey my appreciation for your kind-heartedness supporting those people who absolutely need guidance on this one subject matter. Your personal dedication to passing the solution around was amazingly powerful and has in every case permitted regular people just like me to attain their ambitions. Your entire useful instruction can mean a lot to me and substantially more to my office colleagues. Thank you; from each one of us.

  14. I simply wanted to write down a brief note in order to say thanks to you for those nice techniques you are writing on this website. My extended internet research has now been honored with reputable details to talk about with my company. I would mention that many of us readers are unequivocally endowed to dwell in a perfect site with many outstanding professionals with very helpful basics. I feel extremely blessed to have used the webpages and look forward to many more awesome moments reading here. Thanks again for a lot of things.

  15. hyperdunks说道:

    A lot of thanks for your own work on this site. My niece really loves conducting internet research and it's really easy to understand why. We know all concerning the dynamic form you give vital ideas through your web site and as well as cause response from visitors about this concept while our own child has always been learning a lot. Take pleasure in the remaining portion of the year. Your carrying out a good job.

  16. crazy explosive说道:

    I in addition to my pals appeared to be checking the best helpful tips found on your site and immediately got an awful suspicion I had not expressed respect to you for those tips. All the young men appeared to be certainly joyful to study them and already have really been taking advantage of them. I appreciate you for indeed being really considerate and also for settling on these kinds of fantastic resources millions of individuals are really wanting to be informed on. My very own honest apologies for not saying thanks to you earlier.

  17. I am just commenting to let you understand what a impressive discovery my princess had going through your web page. She even learned too many details, with the inclusion of how it is like to have a marvelous helping style to let other folks without problems learn about various impossible subject matter. You actually exceeded visitors' expectations. Thank you for delivering those warm and friendly, healthy, revealing and as well as cool thoughts on the topic to Emily.

  18. adidas yeezy说道:

    I'm commenting to make you know of the really good encounter my cousin's princess went through studying your web page. She learned a wide variety of details, not to mention how it is like to have an excellent teaching spirit to let many people effortlessly learn about specific very confusing matters. You really did more than our expectations. Many thanks for giving such necessary, safe, explanatory and easy tips on this topic to Jane.

  19. yeezy shoes说道:

    I needed to put you one very little note to say thank you yet again for the precious basics you have shown in this case. It was certainly pretty generous of people like you to convey publicly what exactly some people would have advertised for an e-book in order to make some profit on their own, notably considering the fact that you could have tried it in the event you decided. Those ideas also served like the fantastic way to be sure that the rest have similar eagerness like my own to know somewhat more with respect to this problem. I believe there are a lot more fun occasions up front for folks who view your blog.

  20. I definitely wanted to post a quick word in order to thank you for some of the fabulous techniques you are giving on this site. My extended internet research has finally been compensated with awesome points to write about with my two friends. I would assume that we website visitors are rather blessed to live in a very good site with so many wonderful professionals with useful solutions. I feel rather blessed to have come across the site and look forward to really more awesome minutes reading here. Thanks once again for everything.

  21. yeezy boost 350说道:

    I needed to put you that little remark just to thank you very much as before for the superb views you've discussed here. This has been quite pretty open-handed with you to give without restraint what many individuals could have advertised for an electronic book in making some money for themselves, mostly given that you might well have tried it in the event you wanted. The creative ideas additionally worked to be a easy way to comprehend other individuals have a similar interest like my very own to see good deal more on the subject of this issue. I believe there are lots of more pleasant moments up front for individuals who scan through your blog post.

  22. cat boots说道:

    Thank you for each of your work on this web page. My aunt take interest in doing investigations and it's simple to grasp why. All of us notice all about the powerful method you provide sensible suggestions via your web blog and therefore inspire contribution from visitors about this concern plus our own daughter is certainly starting to learn a lot of things. Take pleasure in the rest of the new year. You have been conducting a good job.

  23. I needed to post you one little bit of word to say thanks a lot over again for all the striking tips you have shown on this page. This is really generous with people like you to provide extensively what exactly a lot of folks could have distributed as an e-book to end up making some bucks on their own, even more so considering that you could have done it if you ever considered necessary. The techniques as well worked like the easy way to comprehend the rest have a similar interest just like mine to realize somewhat more related to this problem. I am sure there are lots of more pleasurable occasions in the future for folks who discover your blog.

  24. yeezy 500说道:

    I wish to show my love for your generosity supporting all those that should have help on this one question. Your real commitment to passing the solution throughout came to be quite valuable and have without exception empowered some individuals just like me to reach their objectives. Your amazing warm and helpful publication entails a lot a person like me and even more to my peers. Thanks a ton; from all of us.

  25. I would like to show some appreciation to you for rescuing me from this particular instance. Right after researching through the world-wide-web and meeting principles which are not productive, I was thinking my entire life was gone. Existing devoid of the approaches to the difficulties you've solved as a result of your entire review is a crucial case, as well as the ones that might have in a negative way affected my entire career if I hadn't come across your website. Your main capability and kindness in maneuvering all the stuff was valuable. I don't know what I would've done if I had not come across such a thing like this. I can also at this point look ahead to my future. Thanks a lot so much for your professional and sensible guide. I won't be reluctant to endorse your web page to any person who should have direction about this topic.

  26. bape hoodie说道:

    I want to convey my passion for your kind-heartedness for persons that should have guidance on this particular niche. Your personal commitment to passing the solution around was rather interesting and has enabled somebody like me to reach their endeavors. Your entire important recommendations indicates much a person like me and a whole lot more to my mates. Many thanks; from all of us.

  27. curry 5说道:

    I'm also writing to make you understand what a nice encounter my child developed viewing your blog. She noticed a wide variety of issues, which included what it's like to have a very effective helping mood to let many others very easily learn about chosen specialized things. You actually exceeded our own expected results. Thank you for supplying such effective, healthy, educational and also unique thoughts on the topic to Tanya.

  28. kobe 9说道:

    I'm also writing to make you know of the cool encounter my child went through using your site. She discovered many pieces, including what it is like to have an excellent giving nature to make many more clearly know just exactly specific specialized things. You really did more than readers' expected results. Thanks for displaying those powerful, healthy, edifying and as well as fun tips about this topic to Sandra.

  29. balenciaga说道:

    I am also commenting to let you understand of the beneficial encounter my child undergone visiting your blog. She discovered numerous details, not to mention what it is like to possess a very effective coaching mindset to make other people without hassle know precisely various complex subject areas. You undoubtedly surpassed people's desires. I appreciate you for presenting such necessary, trusted, informative as well as unique tips on that topic to Gloria.

  30. Thanks so much for giving everyone an extremely terrific opportunity to read from this web site. It really is very pleasurable plus jam-packed with a great time for me and my office friends to visit your website at a minimum thrice a week to study the newest things you will have. And of course, I am also certainly happy concerning the unbelievable pointers served by you. Selected 4 tips in this posting are particularly the most efficient we have had.

  31. My husband and i got quite peaceful Emmanuel could do his research using the ideas he came across using your web page. It's not at all simplistic to just be releasing ideas that many others have been selling. And now we fully grasp we need the website owner to give thanks to for that. Most of the illustrations you made, the easy website menu, the friendships your site help instill - it is everything overwhelming, and it's letting our son in addition to the family consider that the subject matter is pleasurable, and that is seriously fundamental. Thank you for the whole thing!

  32. I in addition to my buddies have already been examining the great information on your web blog and unexpectedly came up with an awful suspicion I never expressed respect to the website owner for them. These people had been as a result passionate to learn all of them and already have actually been enjoying those things. I appreciate you for actually being very kind and also for settling on this kind of really good subjects millions of individuals are really eager to discover. My personal honest regret for not saying thanks to earlier.

  33. nike react说道:

    I simply wished to say thanks again. I do not know the things that I would've accomplished in the absence of the entire secrets discussed by you regarding this area of interest. Entirely was a very depressing concern in my opinion, but taking a look at a new professional form you processed that forced me to weep over joy. Now i am happy for this help and then trust you know what a great job that you're getting into instructing the others thru your blog. I am sure you have never come across all of us.

  34. yeezy boost 350说道:

    Thanks so much for providing individuals with remarkably nice opportunity to discover important secrets from here. It can be so brilliant and also stuffed with fun for me and my office fellow workers to visit the blog on the least thrice a week to read the newest guidance you have got. And indeed, I am also actually pleased for the special tips served by you. Selected 1 tips in this article are undeniably the very best I've had.

  35. I in addition to my pals ended up following the good recommendations located on the blog then immediately I got a terrible feeling I never thanked you for those secrets. These men are actually as a result joyful to read them and already have truly been enjoying them. Appreciate your simply being simply kind and then for obtaining certain smart subject areas millions of individuals are really wanting to be aware of. My personal sincere regret for not expressing gratitude to you sooner.

  36. yeezy boost 350说道:

    I would like to show my appreciation for your generosity for folks who really want assistance with this important area of interest. Your very own dedication to passing the solution around appeared to be especially functional and has consistently empowered men and women like me to reach their targets. Your new insightful guideline entails a lot to me and somewhat more to my peers. With thanks; from all of us.

  37. Thank you a lot for providing individuals with an exceptionally pleasant possiblity to read articles and blog posts from this website. It's always so beneficial plus jam-packed with a great time for me personally and my office friends to search your site particularly 3 times a week to find out the new things you have got. And of course, we're always impressed with the mind-boggling thoughts you give. Some 4 ideas on this page are particularly the very best I have ever had.

  38. adidas nmd说道:

    I wish to voice my passion for your generosity supporting men and women who really want guidance on the study. Your special dedication to getting the solution all-around had been exceptionally valuable and has usually enabled most people just like me to get to their objectives. Your own insightful recommendations implies so much to me and especially to my peers. Thanks a ton; from everyone of us.

  39. adidas gazelle说道:

    Thanks so much for giving everyone an exceptionally wonderful chance to check tips from here. It can be so cool plus full of a good time for me and my office friends to visit your web site nearly three times in 7 days to see the newest tips you will have. Of course, I am also actually motivated for the eye-popping tips you give. Selected 1 areas in this article are undoubtedly the most effective we have all had.

  40. yeezy boost说道:

    I want to show appreciation to you for bailing me out of this predicament. As a result of searching through the internet and meeting tips which were not productive, I figured my life was done. Being alive without the presence of answers to the difficulties you've resolved by means of your guide is a critical case, and the ones that could have adversely damaged my entire career if I hadn't encountered the blog. Your own competence and kindness in handling all the stuff was priceless. I'm not sure what I would've done if I had not encountered such a step like this. It's possible to at this point look forward to my future. Thanks for your time very much for this skilled and results-oriented help. I won't think twice to propose your web site to any individual who requires guidance about this subject.

发表评论

电子邮件地址不会被公开。 必填项已用*标注