Mitigating CSRF attacks on OAuth 2.0 and OpenID Connect

Wanpeng Li,Chris J Mitchell,Thomas Chen

DOI: https://doi.org/10.48550/arXiv.1801.07983

2018-01-24

Abstract:Many millions of users routinely use their Google, Facebook and Microsoft accounts to log in to websites supporting OAuth 2.0 and/or OpenID Connect-based single sign on. The security of OAuth 2.0 and OpenID Connect is therefore of critical importance, and it has been widely examined both in theory and in practice. Unfortunately, as these studies have shown, real-world implementations of both schemes are often vulnerable to attack, and in particular to cross-site request forgery (CSRF) attacks. In this paper we propose a new technique which can be used to mitigate CSRF attacks against both OAuth 2.0 and OpenID Connect.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the cross - site request forgery (CSRF) attack problem that is widespread in OAuth 2.0 and OpenID Connect implementations. Specifically:

1. **Background problems**:
- OAuth 2.0 and OpenID Connect are widely used for single - sign - on (SSO), enabling users to log in to third - party websites using accounts such as Google and Facebook.
- However, the actual implementations of these protocols often have security vulnerabilities, especially being vulnerable to CSRF attacks.

2. **Specific problem description**:
- CSRF attacks allow attackers to send malicious requests to the target website using the user's browser without the user's consent, thereby obtaining authorization or accessing protected resources.
- Attackers can associate the victim's session with the attacker's resources by forging authorization requests, causing the victim to perform operations for the attacker without knowing it.

3. **Deficiencies of existing solutions**:
- Although the OAuth 2.0 specification recommends using the `state` parameter to prevent CSRF attacks, in practice, many relying parties (RPs) do not correctly implement this defense measure.
- Other common CSRF defense mechanisms (such as Referer headers, Origin headers, custom HTTP headers) are not applicable in the OAuth 2.0 framework because these mechanisms cannot handle cross - site redirection situations.

4. **Goals of the paper**:
- Propose a new technique to effectively mitigate CSRF attacks against OAuth 2.0 and OpenID Connect.
- This new technique aims to overcome the limitations of existing defense mechanisms and is easy to implement to ensure wider adoption and higher security.

Through the above analysis, the paper aims to provide a more reliable and practical solution to enhance the security of OAuth 2.0 and OpenID Connect in practical applications and prevent potential harm to users caused by CSRF attacks.