OAuth / OAuth Session Fixation Advisory

There is a session fixation attack against OAuth 1.0. There is a security advisory. There have been a lot of mailing list threads on this. There was a meetup on Friday to talk about the problem. Folks from Yahoo, MySpace, Google, LinkedIn, and Plaxo attended. We discussed two proposals: Signed Callback URLs Signed Approval URLs (A large number of other proposals were discussed briefly, but aren

[tsupo]

「OAuth のセキュリティホールをどうやって直すことにしたか」を解説