Based on https://www.rfc-editor.org/rfc/rfc8252
In a scenario where i have a
Native windows client app (WPF) that uses AUTHORIZATION_CODE flow with PKCE and a loopback redirect URI based on https://www.rfc-editor.org/rfc/rfc8252#section-7.3
Participants
- MyApp: The valid WPF using "MyApp-ClientId" "MyAppScope" and redirect local loopback address "http://localhost:5000"
- MaliciouseApp: The app try to get a token
- MyAppUser: The user that allows the access to its resources
MyApp is considered public client (so we will not consider a ClientSecret)
Now given
- "MyApp" registers a listener on "http://localhost:5000"
- "MyApp" start the flow with "MyApp-ClientId"
- "MyAppUser" logs in AuthorizationServer and confirms that "MyApp-ClientId" is allowed to use "MyAppScope".
- the login for AuthorizationServer is stored in browser as "singlesignon" cookie
- the grant to "MyAppScope" is stored in AuthorizationServer for 30 days
- redirect to "http://localhost:5000" happens (deregisters the listener)
- "MyApp" uses AUTHORIZATION_CODE to receive ACCESS_TOKEN
Now the MaliciouseApp tries to get a token
- "MaliciouseApp" registers a listener on "http://localhost:5000"
- "MaliciouseApp" start the flow with "MyApp-ClientId"
- "MyAppUser" is already logged in to AuthorizationServer
- The grant for "MyApp-ClientId" and "MyAppScope" is already granted
- The redirect to "http://localhost:5000" happens (deregisters the listener)
- now "MaliciouseApp" uses AUTHORIZATION_CODE to receive ACCESS_TOKEN
Is this a possible attack vector or did i forget something ?