In the context of digitial credential ecosystems and specifically the EU Digitial Identity (EUDI) Wallet, there have been discussions recently whether to adopt the W3C Digital Credentials API (DC API) or not. While the API promises various improvements (e.g., wallet selection) and brings drawbacks in other areas, it is important to understand a specific type of security issue that can only be…
By Fabian Hauck (yes.com), Joseph Heenan (Authlete), Daniel Fett (yes.com) OAuth flows on mobile devices can benefit a lot from native apps. With native apps, for example, it is possible to use already existing sessions and biometric authentication features. While apps improve the user experience, they also bring new security challenges to OAuth, especially for services like open banking. This…
To secure data in transport for web services and web sites, TLS is indispensable. But just enabling TLS is not enough: Several different TLS versions and many dozens of options exist for their usage, and it is very hard to tell which combinations are secure and which are not, and which are compatible with certain browsers and devices. In this howto, I introduce TLS Profiler, a new open source tool…
Traditionally, the state parameter is used to provide protection against Cross-Site Request Forgery (CSRF) attacks on OAuth. The newer mechanisms PKCE (RFC7636) and the OpenID Connect parameter nonce not only protect against CSRF, but they also provide some level of protection against Code Injection attacks. In this document, I evaluate (informally) the differences in the provided protection…
This document outlines attacker models considered for DPoP.
A Mix-Up Attack on OAuth is an attack wherein the attacker manages to convince the client to send credentials (authorization code or access token) obtained from an “honest” authorization server to a server under the attacker’s control. In this analysis, I revisit simple mix-up attacks and mix-up attacks with OAuth Metadata and try to find out what happens if we put Pushed Authorization Requests…
The OAuth Security BCP contains a number of new and updated recommendations on the usage of OAuth 2.0. I recommend reading the whole document to understand the threats and attacks that lead to these guidelines. As a quick reference, the following table shows an overview of the most important new recommendations:
RFC7749 defines Version 2 of “xml2rfc”, an XML-based format for authoring RFCs. The xml2rfc v2 format is the preferred format for uploading RFCs to the IETF. There is also the newer Version 3 of xml2rfc, but it is not yet supported for IETF RFCs. (The Version 3 XML still looks similar to Version 2 XML, but supports more features, for example, figures in enumerations.) As far as I can see, there…
Dieser Artikel feiert 2026 sein 20-jähriges Jubiläum und war einer der ersten Beiträge auf meiner Website. Es ist schön zu sehen, dass er sich weiterhin großer Beliebtheit erfreut und daher bleibt er auch noch eine Weile hier. "Reguläre Ausdrücke" sind eine Art Sprache, die beim Programmieren für diverse Problemlösungen verwendet werden kann, insbesondere dann, wenn es darum geht, Zeichenketten…