neraliu's blog internet profession in between hongkong/china and silicon valley (no longer, but the world!)

oauth session fixation attack

when you are looking into the above first diagram of the oauth normal authentication, you can notice the user authentication session is identified by the "oauth_token" in which the token is exposed to the user without protection. what is the implication of it? kind of familiar! yes, it is cross site request forgery and session fixation attack, asking people to do something through phishing with specific session identified by the unauthorized person. as you know, the server cannot identified the client id, so that it happens, thinking in this direction, the fix of the issue is kind of obvious, add back the client identifier back to the protocols.

• reference - http://www.hueniverse.com/hueniverse/2009/04/explaining-the-oauth-session-fixation-attack.html