Last week a major flaw was reported in implementations of widely used authentication and authorization standards, OAUTH and OpenID. Many consumer and enterprise SaaS apps let users authenticate using these standards. This vulnerability, called “Covert Redirect,” enables attackers to insert themselves into the URL redirect path during the authentication process.
This flaw, though recently reported, isn’t new. Security researchers have noted similar problems in the way OAUTH redirects users after authentication.
One way to fix this is for SaaS apps (OAUTH providers) to have a allow list of URLs for every application that is registered to use OAUTH tokens. Some OAUTH providers are already doing this, and others have said they will do so in the future.
OAUTH and OpenID are important advances in authentication and authorization standards that allow users to securely grant access. They are an important part of the cloud SaaS app ecosystem that allows for SaaS apps to be tied together in a complementary way. However, consumers and enterprise administrators need to be aware of the risks of using OAUTH so that they can monitor and take appropriate action.