Later archive addition

A Comprehensive Formal Security Analysis of OAuth 2.0

Daniel Fett, Ralf Kuesters and Guido Schmitz · arXiv.org

The first formal analysis of the OAuth 2.0 standard in an expressive model of the web, covering all four grant types with malicious relying parties, identity providers and browsers in scope. It uncovers four attacks that break OAuth's authorization, authentication and session integrity guarantees and carry over to OpenID Connect, proposes fixes, and proves the fixed protocol secure.

Record

Researcher

Daniel Fett, Ralf Kuesters and Guido Schmitz

Published by

arXiv.org

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• oauth
• openid
• sso
• auth-bypass
• formal-analysis
• session-fixation
• csrf
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Daniel Fett, Ralf Kuesters and Guido Schmitz, first published at the original source. Preserved copies are kept so the citation survives its host.