Is it bad to have access token in OAuth redirect URL

user_5221120 0
Viewed 1126

I am building an oauth login flow and I am not sure if I have done it wrong because I will need to send the bearer token back via redirect URL, like /oauth2/redirect?token=[TOKEN]. But isn't it not recommended to have token passed along through URL? As it is pointed out in this thread:

Don't pass bearer tokens in page URLs: Bearer tokens SHOULD NOT be passed in page URLs (for example, as query string parameters).

Instead, bearer tokens SHOULD be passed in HTTP message headers or message bodies for which confidentiality measures are taken. Browsers, web servers, and other software may not adequately secure URLs in the browser history, web server logs, and other data structures.

If bearer tokens are passed in page URLs, attackers might be able to steal them from the history data, logs, or other unsecured locations.

I must have missed something in the whole flow and would like to understand more about this matter. Any input is appreciated!

UPDATE

Might not be correct but this is my understanding after some digging. The three means to pass token:

  1. URL (not preferable)
  2. Auth header
  3. Request body

But under the oauth redirect use case, option 2 and 3 not feasible. So option 1 is the only option available. If really needed, token can be encrypted to ensure security.

jwt oauth rest
2 Answers

I think this only means, that you should not use a GET request when the server requires the token, instead you should use POST or whatever is appropriate. In a GET request the parameters are included in the URL and those can end up in logs or other histories, other request types will send the paramters separat from the request URL.

P.S. BTW if you are not implementing the OAuth server yourself, you won't have to send a redirect url containing the token.

user_5757650

The basic auth header which provides a little extra security as it's required to be through TLS:

In the case of a "Basic" authentication like shown in the figure, the exchange must happen over an HTTPS (TLS) connection to be secure.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication

Also, the headers aren't logged in easy places like browser history.

From the spec,

it SHOULD NOT be used unless it is impossible to transport the access token in the "Authorization" request header field or the HTTP request entity-body.

https://www.rfc-editor.org/rfc/rfc6750#section-2.3

user_55272130
Related