当前 OAuth 1.0 规范 - 它如何解决会话固定攻击？
我已经按照 此规范实现了 OAuth 1.0 提供程序，这应该是最新的。该规范已进行修订，以解决2009 年发现的会话固定攻击。问题是，除了必须区分这两个规范之外，我不确定规范中添加/更改了哪些措施来应对该问题。
自从我实施了“正确的”规范以来，我很难向利益相关者解释我采取了哪些措施来减轻风险。
有人愿意为我阐明这个问题吗？
I've implemented an OAuth 1.0 provider following this specification, which should be the latest. The specification was amended to address the session fixation attack that was identified in 2009. The thing is, short of having to diff the two specifications I am unsure as to what measures were added/changed in the spec in response to the issue.
Since I implemented the "right" spec I am having a hard time explaining to stakeholders what measures I have taken to ameliorate the risks.
Anyone care to shed some light on the issue for me?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
1.0a 解决了此处描述的非常具体的攻击：
解释 OAuth 会话固定攻击
1.0a addresses a very specific attack described here:
Explaining the OAuth Session Fixation Attack
oauth_callback参数。oauth_callback_accepted响应参数指示正在使用 OAuth 1.0a。oauth_verifier参数由服务提供商在身份验证/同意阶段生成。oauth_verifier必须在访问令牌生成步骤中发送。请参阅http://wiki.oauth.net/w/page/12238555/签署%20Callback%20URLs了解更多详情。
oauth_callbackparameter is now required in the request token generation step. Theoauth_callback_acceptedresponse parameter indicated OAuth 1.0a is being used.oauth_verifierparameter is generated by the service provider during the authentication/consent phase.oauth_verifiermust be sent at the access token generation step.See http://wiki.oauth.net/w/page/12238555/Signed%20Callback%20URLs for more details.