Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

OAuth 2.0 and OpenID Connect

OAuth 2.0 and OpenID Connect

1.[3p]

Match each OAuth role to what it does.

  • Resource owner

  • Client

  • Authorization server

  • Resource server

  • your application, treated by the protocol as untrusted

  • the user, the only party who can grant access to their data

  • holds the data and accepts access tokens

  • the only party that ever sees the user's password

Show the answer

Resource owner: the user, the only party who can grant access to their data Client: your application, treated by the protocol as untrusted Authorization server: the only party that ever sees the user's password Resource server: holds the data and accepts access tokens

2.[3p]

Put the authorization code flow in order.

  1. The client posts the code and verifier to the token endpoint, server to server

  2. The authorization server redirects back with a code and the same state

  3. The user authenticates and consents at the authorization server

  4. The client redirects the browser with a code challenge and state

Show the answer

c, b, d, a

3.[3p]

A PKCE code verifier is 32 random bytes encoded as base64url. How many characters long is it?

CorrectNot quite: 43

4.[3p]

code_challenge_method=plain puts the verifier itself in the authorization URL. What does that cost?

Correct
The answer is: Everything, since the attacker PKCE was written for is the one who can read the authorization request
The answer is: Everything, since the attacker PKCE was written for is the one who can read the authorization request
The answer is: Everything, since the attacker PKCE was written for is the one who can read the authorization request

5.[3p]

What attack does state prevent?

Correct
The answer is: An attacker feeding their own authorization code to the victim's callback, linking the victim's session to the attacker's provider account
The answer is: An attacker feeding their own authorization code to the victim's callback, linking the victim's session to the attacker's provider account
The answer is: An attacker feeding their own authorization code to the victim's callback, linking the victim's session to the attacker's provider account

6.[2p]

An authorization server may safely match a registered redirect URI by prefix, so long as the host is exact.

The answer is: False
Correct

7.[3p]

Why is signing a user in from an access token plus a userinfo call unsafe?

Correct
The answer is: Any access token for that scope works, whoever it was issued to, so an attacker's own client can relay one
The answer is: Any access token for that scope works, whoever it was issued to, so an attacker's own client can relay one
The answer is: Any access token for that scope works, whoever it was issued to, so an attacker's own client can relay one

8.[3p]

Which checks must an ID token pass before you read sub from it?

Select all that apply

Correct
Correct
Correct
The answer is: The signature verifies against the provider's published key set, `aud` contains your own client ID, `nonce` matches the value you sent with the authorization request

9.[2p]

Which claim, paired with iss, is the stable identifier to link a local account to? One word.

CorrectNot quite: sub