Federated Login CSRF
summary
A multi-tenant cloud app allows an attacker to sign up a tenant, federate a malicious IdP, obtain an ID token for the attacker, and force a victim’s browser to accept the attacker’s session cookie via the OpenID Connect redirect flow; once that attacker session exists the app can auto-link the victim’s social OAuth account and leak or misuse the victim’s data. An AD FS auto-signin demo shows this works by injecting onload JavaScript that posts credentials. Defenses: require and validate state, add a second consent step, or use always_prompt.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:34Quick Recap - Federated Login
- 5:52Additional CSRF Scenarios
- 6:25OAuth Code Grant Flow
- 10:17Recommended State parameter
- 11:10OpenID connect login flow
- 15:07Risk in the current scenario
- 18:09Recommended Parameter from OpenID Connect Spec
- 18:52Federated Login CSRF (Pre-Conditions)
- 19:49Attacker configuration
- 20:42Attack data flow sequence
- 23:47Risks
- 24:15Demo
- 27:48Mitigation 1: Show a 2nd Consent dialog before linking identities
- 29:12Conclusions
related talks
51mCross-Tenant Request Forgery Attack in Multi-Tenancy Environments
22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On
57mOpenID Connect Architectural Patterns
37mCustomer Identity for Modern Apps and APIs
31mLog In Through the Front Door: Automating Defense Against...
53mOAuth2/OIDC security weaknesses and pitfalls
26mTechnical Tracks
41mBeginner’s Guide to Bypassing Modern Authentication Methods to SSO