When we use the authorization code flow in the OIDC, I go to /authorization and then it redirect me to the OIDC provider's login page. On this login page there is something like redirectUrl query string, which contains link to /authorization with parameters like client_id, state, code_challenge etc. When I'm writing OIDC server, should I worry about this, that these parameters can be changed while user is on login page (e.g. by a malicious extension in the browser)? Maybe should I save these parameters in httponly, secure cookie after GET request on login page?
Security of the OIDC login page with authorization_code flow
171 Views Asked by Szyszka947 At
1
There are 1 best solutions below
Related Questions in SECURITY
- HTTPS configuration in Spring Boot, server returning timeout
- HSM ZKA control mask values
- OWASP Amass Subcommands
- Is there a need for BPF Linux namespace?
- Error when trying to execute a binary compiled in a Kali Linux machine on an Ubuntu system
- When sanitize/encode while implementing tags system like on SO
- spring security version in spring-boot-starter-security
- I am currently trying to implement a rudimentary firewall from a video I watched but the nimda worm detection is not working and i do not know why?
- Is it possible for `sudo` to fail temporarily with the correct password? Hacking suspected
- Is it viable proxying all my mobile apps requests, to some kind knowing that a request is coming from a secure source
- What abilities should I concentrate on while bug hunting, and how can I improve the quality of my bug bounty reports?
- System.ArgumentOutOfRangeException: I passed this error in every single program
- How to prevent users from creating custom client apps?
- Does server-side content security policy exist for youtube video player API, app, mod apks and website?
- Can we pass a hostname/IP address as a query string in a GET request in REST API
Related Questions in OPENID-CONNECT
- Error from Identity Provider - OIDC Scope Error
- Blazor Web App (.Net 8) with oidc loses auth when switching to client
- Call Databricks API from an ASP.NET Core web application
- OIDC Error after adding Microsoft.IdentityModel.JsonWebTokens
- Implementing IDP Initiated Flow Using OIDC
- How can I add an identity provider to an existing user in an AWS Cognito user pool using the OIDC protocol?
- How can I protect an Java Spring boot API against Azure AD B2C if I only have an id_token?
- Migrating .gitlab-ci.yml from Terraform to OpenTofu with OIDC Setup
- Cookie not being set when using Blazor server App with individual authentication hooked up with Duende IdentityServer
- Blazor Web Assembly Standalone OIDC
- Azure AD OIDC authentication for S3 upload
- OIDC - Dummy Redirect URL a security issue?
- OPEN ID connect request to refresh access token
- Prevent deeplinking on redirect
- Google OIDC: How to get the member_key of an external SSO user?
Related Questions in OPENID-PROVIDER
- How to fix RPError: nonce mismatch, expected xxxxx, got: undefined" error using casdoor OIDC
- OAUTH2 token_key endpoint, security of key exchange
- How can Firebase Auth users sign in to Budibase?
- Keycloak Gatekeeper failing with session not found error while securing a application
- Getting TypeError: client_secret_basic client authentication method requires a client_secret
- Creating anonymmous session using OpenID Connect Auth Server
- Persist additional claims and tokens from external providers in ASP.NET Core
- Response URI for Azure AD B2C returns 404, custom OpenID identity provider
- Error: "message":"PermissionDenied","type":"DomainError" after user tried to log in
- nifi 1.17 + oidc UI timing out - Unauthorized error="invalid_token" Expired JWT
- Questions about OIDC FAPI and mTLS
- How to migrate from PrivateKeyByes to PrivateKey on the ASPNET OAuth Provider
- out of band communication without OIDC CIBA
- Node-oidc-provider How to store clients in database
- Custom openid connect provider adb2c
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
hiding
/authorizeparameters beyond a plain sight of the user does not protect them from man-in-the-browser[1] attacker, where he/she would be able to access those data anyway.OIDC specification allows to pass requests via JWT tokens which can optionaly be signed or even encrypted which should provide extra level of security in considered cases [2, 3].
As IDP you might defend you users with incorporating out-of-band transaction verification [1], where if user is aware about requested login transactions, might infere that extra transaction is being made on his/her behaf or confirming message is missing in the authentication flow.
Also IDP instance should protects itself from registering services from unauthorized parties in order to prevent attackers from creating phishing sites, pretending being a legitimate service using legitimate IDP. The
/authorizerequest contains service credentials (client id, client secret) which must be correctly verified by the IDP.For more practical elaboration I'd recommend pentesterlab.com where Authentication/Authorization badge exercise series will allow you to learn and practice several attacks on OAuth and OIDC protocols and implementations.