5 ms·

I'm not sure I understand the concern with integrity of OAuth 2.0 payloads. Sending the request over HTTPS already ensures that the request is not tampered with

• bootloop 8y ago
  Wouldn't this be a reasonable reason if you consider that they might use additional equipment to terminate HTTPS connection in an early layer of their network?
• gsich 8y ago
  no. You don't know where the TLS terminates.
• geocar 8y ago
  Breaking IP (e.g. MITM the server) means you get a TLS certificate anyway. This might be easier done than said[1]. Breaking IP might not even be necessary because programmers are dumb[2]. [1]: https://www.bleepingcomputer.com/news/security/dns-poisoning-or-bgp-hijacking-suspected-behind-trezor-wallet-phishing-incident/ https://www.bleepingcomputer.com/news/security/dns-poisoning... [2]: http://web.archive.org/web/20120317165131/http://forum.developers.facebook.net/viewtopic.php?pid=258460 http://web.archive.org/web/20120317165131/http://forum.devel...
• dogma1138 8y ago
  No it can potentially ensure integrity between the a client and the first TLS hop that’s about it. You don’t know which client it actually came from and you can’t ensure integrity within the transaction flow of your app. Say the request terminated at a LB proxy then passed through and API gateway into an MQ then goes through multiple servers you need some form of integrity checking for the request and OAUTH 2.0 doesn’t provide it.