Security Issues in OAuth 2.0 SSO Implementations

摘要: Many Chinese websites (relying parties) use OAuth 2.0 as the basis of a single sign-on service to ease password management for users. sites support five or more different identity providers, giving users choice in their trust point. However, although has been widely implemented (particularly China), little attention paid security practice. In this paper we report on detailed study implementation ten major providers and 60 relying parties, all based China. This reveals two critical vulnerabilities present many implementations, both allowing an attacker control victim user’s accounts at party without knowing account name password. We provide simple, practical recommendations parties enable them mitigate these vulnerabilities. The have reported concerned.