OAuth 2 - Security Best Current Practices
Some notes from a couple of really quick presentations regarding OAuth 2.0, it went really fast thus challenging to note things down; hopefully will set the path to develop the topic further with this as a starting point.
Best Current Practices
I got a couple of them —BCPs for short— to start with, around some of the traditional flows:
Furthermore, the use of the following flows is discouraged:
- OAuth 2.0 Implicit grant —a good writ about it on medium
- Password Grant —as it is incredibly susceptible to phishing attacks.
More on the Password Grant, an excerpt from Okta
The Password grant is used when the application exchanges the user’s username and password for an access token. This is exactly the thing OAuth was created to prevent in the first place, so you should never allow third-party apps to use this grant.
Machine-To-Machine Flow
Backend-2-Backend is usually where I usually dwell therefore found quite interesting flows such as On-Behalf-Of as the means for authentication/authorization; there were of course some advice for authentication in particular:
- Shared secrets are not recommended❌ as they easily leak, if used however, they should have high entropy and stored safely.
- Better favor mechanism based on **Asymmetric Keys:**✓
- Look into Singed JWT or Mutual TLS.✓
Another good advice was to always include the ‘typ’ header attribute, to properly identify a JWT token and not be confused as any other token type:
{
'typ': 'at+jwt'
...
}
That identifies the token as JWT Token, preventing applications confusing them with other types. Other interesting concepts that were brought up during the sessions are listed below:
- Sender-Constrained Tokens —described at 4.8.1.1.2. Sender-Constrained Access Tokens in the IETF draft
- Proof-of-Possession Access Tokens -described in this IETF Memo, also a write-up about it here to complement things.
- Bringing Mutual TLS & X.509 Certificates into the mix —as described by this IETF Memo.
- JWT-secured Authorization Requests
- AuthZ Code Flow + PKCE —which is an extension of the /Authorization Code Flow/; here’s also the IETF Draft
And finally, some tools mentioned and used during the session: