2018/01/24 by Wanpeng Li, Li, Wanpeng, Chris J. Mitchell +3
Computer Science · #Cryptography and Data Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing #Web Application Security Vulnerabilities
paper · pdf · doi:10.48550/arxiv.1801.07983
openalex publication_date 2018/01/24 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Many millions of users routinely use their Google, Facebook and Microsoft accounts to log in to websites supporting OAuth 2.0 and/or OpenID Connect-based single sign on. The security of OAuth 2.0 and OpenID Connect is therefore of critical importance, and it has been widely examined both in theory and in practice. Unfortunately, as these studies have shown, real-world implementations of both schemes are often vulnerable to attack, and in particular to cross-site request forgery (CSRF) attacks. In this paper we propose a new technique which can be used to mitigate CSRF attacks against both OAuth 2.0 and OpenID Connect.