目前，我正在对实习公司进行研究。该公司使用OAuth2方法在公司Web App Services和合作伙伴的API之间进行集成，但不支持知道用户是谁。另外，我发现该公司将刷新令牌和访问令牌放在Web浏览器上的会话存储中。就我的研究而言，可以使用劫持方法攻击Web应用程序。
另一件事是某些集成仅使用API键进行握手。
我的假设是：
- 公司需要在OAUTH2之前实施OIDC，
- 需要对会话存储的刷新和访问令牌进行加密，但是我不知道
- 只有使用API密钥需要实现OAuth2的公司
是否有可能，或者不是可能的。
- OAuth2方法是最好的方法确保身份验证吗？
- 可以在会话存储Web浏览器上加密令牌吗？
预先感谢：D
Currently, I am doing research on my Internship company. The company uses the OAuth2 method to do Integration between the company web app services and the partner's API, but it's not support knowing who the user is. Also, I found an issue that the company put the refresh token and access token in session storage on web browser. As far my research, the web application can be attacked using the Hijacking method.
The other thing is some of the integration only use API key to do handshakes.
My Hypothesis :
- The company needs to implement OIDC before the OAuth2
- The Refresh and Access token on session storage need to be encrypted, but I don't know it is possible or not
- The company who only using API key need to implement OAuth2
my question :
- is the OAuth2 method the best method secure an Authentication?
- it is possible to encrypt token on session storage web browser?
Thanks in advance :D
发布评论
评论（1）
简短答案：是
您的假设
OIDC基于oauth2的 AN 身份验证 本身具有 tokens
stackoverflow问题
oidc网站
oauth2完全基于http请求，您可以获取令牌并使用令牌并用任何代币来加密它们您想要的加密算法。
oauth2不是API的强制性，如果您已经使用键固定API（我不知道安全级别以及如何创建这些键），则只能使用它们。
问题的答案
oauth2是授权和身份验证方法之一，有很多，并且不是“一件尺寸适合所有”解决方案。
当然！令牌是base64字符串，您可以使用a
最终考虑因素，
我建议您阅读有关OAuth2并尝试一些流，以下是一些资源，您可以在其中玩耍和学习Oauth2
oauth2文档
oauth2 playground
Short answer: Yes
Your Hypothesis
OIDC is based on oAuth2 its an Authentication flow and itself has tokens
StackOverflow question
OIDC WebSite
OAuth2 is based entirely on HTTP requests, you can get the tokens and encrypt them with whatever encryption algorithms you want.
OAuth2 is not mandatory for APIs, if you already secure your APIs with keys (I don't know the security level and how these keys are created) you can only use them.
Question's answers
OAuth2 is one of the authorization and authentication methods, there are many, and it's not a "One size fits all" solution.
Of course! the token is a base64 string, you can use a Crypto library
Final considerations
I suggest you read about OAuth2 and try some flows, below are some resources where you can play and learn OAuth2
OAuth2 Docs
OAuth2 Playground