Twitter @anywhere 安全漏洞？
我正在基于@anywhere 的网页上开发Twitter 应用程序。
我认为 @anywhere 是 Facebook Javascript SDK 的 Twitter 版本（也许这就是我错的地方）。
无论如何，事情是这样的。
您将“Connect With Twitter”代码放在您的网页上，如果用户使用 Twitter 登录并授权您的应用程序，那么您就可以用它做任何您想做的事情。
因此，如果 @user_a 使用他的 Twitter 帐户登录并访问您的网站，您可以执行一些奇特的操作，例如显示 @user_a 关注者或向他们的帐户发送推文等。
问题是这样发展的。假设 @user_a 已经登录到您的应用程序，然后 @user_a 从 Twitter 注销（因为它是公共计算机:/），然后其他人以 @user_b 身份登录 Twitter。如果 @user_b 访问您的 @anywhere 网页，IT 将看到一切，就好像 @user_a 已登录一样！ D：
Twitter 说这一切都很好，因为一切都基于 cookie，并且您应该提供一个按钮，让人们从 @anywhere 注销您的网站。对我来说，这听起来不切实际，因为如果你（用户）想要停止使用 Twitter，你只需从网页上退出即可（就像在 Facebook 上一样）；您不应该记住您已经连接到 Twitter 的哪些网站，并访问它们以退出这些网站，只是为了保护自己免受其他人使用您的帐户的影响。而且，更糟糕的是，该 cookie 很容易被盗，而且你知道故事的其余部分。
我做错了什么吗？我是否认为 @anywhere API 与它的预期有所不同？
I'm developing a Twitter Application on a Web-Page based on @anywhere.
I think of @anywhere as the Twitter version of the Facebook Javascript SDK (maybe that's where I'm wrong).
Anyway, the thing goes like this.
You put "Connect With Twitter" code on your webpage, and if the user is logged in with Twitter and authorizes your application then you can do whatever you want with that.
So if @user_a is logged in with his Twitter account and visits your website, you can do some fancy stuff like showing @user_a followers or tweet to their account or whatever.
The problem develops like this. Suppose that @user_a is alredy logged in into your app, then @user_a logs out of twitter (because it was a public computer :/) and then someone else comes and logs in to Twitter as @user_b. If @user_b goes to your @anywhere web-page IT will see everything as if @user_a is logged in! D:
Twitter says that all that is fine, because everything is based on a cookie AND you should provide a button for the person to log-out of YOUR site from @anywhere. To me that sounds impractical, because if you (user) would want to stop using twitter you just sign out from the webpage and that should be all (like on Facebook); you shouldn't remember, whose sites you already have connected to Twitter, and pay them a visit to sign out from those, just to protect yourself from someone else using your account. And, to make things worse, that cookie could be easily stolen and well you know the rest of the story.
Am I doing something wrong? Am I thinking of the @anywhere API as something different than what it was intended to be?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
@anywhere 不会将自己宣传为 SSO，因此它不需要单一登录断机制。这个想法是使用 @anywhere 登录其他站点，此时这些站点有责任处理会话，包括何时注销用户。就像用户使用两个不同的密码登录站点 a 和站点 b 一样，他们有责任对每个站点进行签名。
虽然保持活动状态的 @anywhere 令牌可以允许后续用户，但令牌仅活动几个小时，从而限制了潜在的损害。
@anywhere doesn't advertise itself as a SSO so it doesn't need a Single sign-off mechanism. The idea is to use @anywhere to log into other sites at which point it becomes those sites responsibility to handle sessions including when to sign the user out. Just like if a user logs into site a and site b with two different passwords it is their responsibility to sign of each site.
While @anywhere tokens left that are left active can allow follow up users the tokens are only active for a few hours limiting the potential damage.