如果提供商可信，通过电子邮件地址识别 OpenID 用户是否安全？
我使用 DotNetOpenAuth 进行 OpenID 登录。 Google 的提供商根据调用者的领域（主机名 + 端口）返回不同的 ClaimedIdentifier。
根据 OpenID 身份验证回调返回的电子邮件地址与声明的标识符本身来验证登录是否安全？也就是说，如果我们验证电子邮件而不是所声称的 ID，用户是否可以伪造自己的电子邮件地址，从而获得对其他用户帐户的访问权限？
我认为只要提供商是可信的就可以这样做 - 即我们可以信任 Google 不允许用户使用其他人的电子邮件地址登录。
I'm using DotNetOpenAuth for OpenID logins. Google's provider returns a different ClaimedIdentifier depending on the realm of the caller (hostname + port).
Is it safe for me to validate a login based on the email address returned by the OpenID authentication callback vs the claimed identifier itself? i.e. is there a way a user could forge their email address and thus gain access to another user's account if we validate on the email instead of the claimed ID?
I was thinking this would be OK to do as long as the provider is trusted - i.e. we can trust Google not to allow a user to sign in using someone else's email address.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
OpenID 2.0 协议的安全模型是围绕声明的标识符（而不是电子邮件地址）构建的。所以最好的方法是让你的 Realm 保持一致。如果你能做到这一点，那就是最好的方法。
将电子邮件地址存储在用户表中也可能是个好主意，这样，如果您的领域必须发生变化（也许您的公司被其他公司收购），您将能够迁移您的用户。但如果您打算这样做，您还应该在收到电子邮件地址时在身份验证过程中存储 OP 端点的内容，以便您知道是否可以信任它。
一般来说，信任电子邮件地址根本不安全。如果您信任提供商（在您的情况下为 Google）向您提供经过验证的电子邮件地址，那么您可以信任这些电子邮件地址（如果您验证确实是对用户进行身份验证的提供商）。 只有通过验证
IAuthenticationResponse.Provider.Uri值是您信任的值才能正确完成此操作。仅通过以下方式不能隐式完成此操作：由于 OpenID 的“未经请求的断言”功能，提供了“使用 Google 登录”按钮，该功能允许用户使用任意提供商登录，无论 RP 在其 UI 中提供什么。由于声明标识符和本地标识符之间的差异，无法通过检查声明标识符的域来完成此操作。The OpenID 2.0 protocol's security model is built around the Claimed Identifier -- not the email address. So the best approach is to make your Realm consistent. If you can do that, that's the best approach.
It may also be a good idea to store the email address in your user's table so that if your realm ever must change (perhaps your company is purchased by another) you'll be able to migrate your users. But if you plan to do this, you should also store what the OP Endpoint was during authentication when you received the email address so you know whether you can trust it.
Generally, it's unsafe to trust the email address at all. If you trust the Provider (Google in your case) to provide you verified email addresses, then you may trust the email addresses if you verify that it is in fact the Provider that authenticated the user. This can only be done correctly by verifying the
IAuthenticationResponse.Provider.Urivalue is the one you trust. It cannot be done implicitly just by only offering a "Log in with Google" button because of OpenID's "unsolicited assertions" feature, which allows users to log in with arbitrary Providers regardless of what the RP offers in its UI. And it cannot be done by checking the domain of the Claimed Identifier because of the difference between claimed and local identifiers.在使用电子邮件进行比较之前，我会验证所声称的 ID 确实是 Google ID。 StackOverflow 也是这样做的。
I'd verify that the claimed ID is indeed a google one before using the e-mail in my comparison. That's how StackOverflow does it, too.