Skip to content

Security consideration: add warning about creating phishing links #69

Description

@aaronpk

Under certain circumstances, PAR could be used to create phishing links at the authorization server's domain. This should be listed as a security consideration, along with the circumstances under which this can happen and how to avoid it.

Specifically, if a public OAuth API (e.g. github, google, twitter) uses PAR, then a malicious developer could register a client with a redirect URI of the attacker's website, then create a PAR request that will redirect to that URI (either with a valid authorization code if the user approves the request, or with an error code if the user denies or if there is some other problem). This also applies to authorization servers supporting unauthenticated dynamic client registration.

The difference between this and the traditional OAuth model is that the malicious redirect would be not visible until after the redirect has happened, whereas in traditional OAuth it would be in the actual authorization URL itself as the redirect_uri parameter. Essentially PAR lets an attacker mask the redirect URI under the opaque request_uri.

There is no mitigation for these situations, so they should be called out so developers are aware of the risk. To avoid the potential for these attacks, the authorization server would need to prevent arbitrary client registration or have a manual approval process.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions