Web Runtime Engine Redirect Interception for OAuth Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Packaged web applications cannot use the OAuth mechanism effectively due to the requirement for HTTP URIs, leading to security vulnerabilities like session fixation attacks when using web runtime engines to capture redirect endpoints.
Innovation Solution
Implementing a method and system that intercepts the redirect endpoint to determine a match between the intercepted redirect identifier and a pre-assigned identifier associated with the client application, ensuring that the redirect endpoint is not from another application, thereby adding an additional authentication layer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If web runtime engine captures redirect endpoint to enable OAuth for packaged web applications, then OAuth functionality is achieved, but security vulnerability to session fixation attacks increases
Solution Approach 1:
The system performs preliminary validation by comparing the captured redirect endpoint URI against a pre-registered redirect URI for the packaged web application before completing the OAuth authorization flow. This preliminary check prevents session fixation attacks by ensuring the redirect endpoint belongs to the legitimate application.
Solution Approach 2:
The system introduces an intermediary validation mechanism between the web runtime engine and the OAuth authorization flow. The intermediary compares URIs and verifies application identity, acting as a security gatekeeper that enables OAuth functionality while blocking malicious session fixation attacks.
2Ease of operation
If redirect endpoint is used for OAuth authorization flow, then client application can access protected resources, but risk of credential misuse by malicious applications increases
Solution Approach 1:
The system performs preliminary verification by matching the captured redirect endpoint URI with the pre-registered redirect URI before granting access to protected resources. This ensures that only the legitimate client application can utilize the OAuth credentials, preventing credential misuse by malicious applications.
Solution Approach 2:
The system implements a feedback mechanism where the captured redirect endpoint is continuously validated against the registered redirect URI. This feedback loop ensures that even if credentials are compromised, the system can detect and block unauthorized access attempts by verifying the redirect endpoint identity.
Data Source
AI summary
A method for authenticating a client application by an authorization server is provided. In the method, the authorization server transmits a first redirect identifier assigned to a client application to a web runtime engine, in response to receiving a registering request to register with the authorization server of the client application; receives an access request to access a protected resource stored on a resource server by the client application: and transmits the access request to the resource server through the web runtime engine using a second redirect identifier corresponding to a redirect endpoint of the client application. The second redirect identifier is intercepted by the web runtime engine, and the protected resource is accessed by the client application based on a comparing result between the first redirect identifier and the second redirect identifier in the web runtime engine.