OAuth 2.0协议在Web部署中的安全性分析与威胁防范

Security Analysis and Vulnerability Management of OAuth 2.0 on Web Deployment

分析了OAuth 2.0协议中两大主流模式的安全机制和实现过程,给出了针对协议中部分敏感数据的威胁模型,针对协议部署过程中常见的安全漏洞提出了访问令牌注入攻击以及针对授权码注入的CSRF攻击的攻击路线,并对若干网站进行测试,结果显示攻击效果良好,验证了攻击方法的有效性,最后提出了相应的防范策略.

This paper analyzes the implementation and security mechanisms of the two mainstream modes of OAuth 2.0,presents a threat model against some sensitive data of the protocol,and proposes token injection attack and CSRF attack for authorization code injection routines against the common loopholes during the deployment of the protocol.The testing results show the attack methods perform well,and the respective prevention strategies are also proposed.