OIDF Workshop at Verizon Media -- 9/30/2019 -- Browser Changes Impa...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Browser Changes impacting
Identity Flows
OpenID Foundation Workshop

Introduction
SameSite Policy Impacts
ITP Policy Impacts
Browser “VPNs” to mask browser IP addresses
navigator.isLoggedIn()...

Acknowledgements
Filip Skokan
Mika Mannermaa
Ajinkya Kshirsagar

SameSite policy changes
SameSite=Strict
● Only sent when page loaded in the browser exactly matches the domain of
the cook...

What is affected by SameSite=strict
It’s fair to say that mostly everything, Client requesting an
authentication/authoriza...

What is affected by SameSite=lax
Any hidden iframe mechanism
● response_mode=web_message used for silently renewing tokens...

What is affected by SameSite=lax
POST based protocol messages
● response_mode=form_post used to return tokens via the fron...

What is impacted by SameSite=none
● Cookies marked as SameSite=none MUST also be flagged as ‘Secure’
● This means that the...

Upcoming Changes to current SameSite policy
● Google calls this Incrementally Better Cookies in their individual draft and...

What the change means
When a set-cookie header does not have a sameSite attribute, instead of
defaulting to none (today’s ...

Impact on Authorization Servers
● Inventory existing flows to determine impact
○ Depending on the existing supported flows...

Impact on Relying Parties
● If a client currently sets their cookies to either of the defined values, it will
continue to ...

Temporary workaround for login flows
● If a cookie has been set (session or persistent) within the last 2 minutes
without ...

SameSite=none webkit bug
Older instances of iOS webkit do not correctly handle a cookie explicitly marked as
SameSite=none...

ITP 2.X
Sites flagged as “tracking sites” have their cookies wiped every 30 days unless the
user explicitly interacts with...

Impact of ITP 2.3
● Since OIDC/OAuth authorization_code flow redirects with query parameters, it
appears this will set the...

Browser based “VPNs”
● Concern that request features like IP address might uniquely identify a user
and enable tracking
● ...

navigator.isLoggedIn() proposal
“For the purposes of client-side storage/state, the behavior of the web platform has been ...

navigator.isLoggedIn() proposal
There are several ways the browser could make sure the IsLoggedIn status is trustworthy:
●...

navigator.isLoggedIn() proposal
Some websites allow the user to use an existing account with a federated login provider to...

HTTP State Tokens
https://mikewest.github.io/http-state-tokens/draft-west-http-state-tokens.html
While not new, this is re...

General Discussion

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

View on Slideshare

1 of 22 Ad

View on Slideshare

1 of 22 Ad