OAuth is an open standard for token-based authorization that allows third-party applications to obtain limited access to a user's data without requiring them to share their passwords. It allows sites to exchange user-authorized tokens that can be revoked and have varying scopes and time limits. OAuth has gone through several versions to address vulnerabilities and inconsistencies, with OAuth 2.0 simplifying the protocol through the use of bearer tokens and authorization/resource server separation. While implementations are emerging, OAuth 2.0 continues to be refined as an IETF draft standard.

1. OAuth: Open Standard for Sharing
#OpenWebTO - June 1st, 2010

2. the problem

5. password anti-pattern

7. Sharing without passwords.
Sites exchange user authorized tokens.
Tokens can be revoked.
Tokens can be scoped.
Tokens can be time-limited.

9. Terminology has changed a lot.
These slides are old school.

11. some history
12/07 - OAuth 1.0
06/08 - OAuth 1.0a
11/09 - OAuth WRAP
03/10 - OAuth 2.0 Draft 1
04/10 - RFC 5849
05/10 - OpenID Connect

12. OAuth 1.0a addresses a session fixation vulnerability discovered in the
original spec.

13. Step 1. Attacker initiates OAuth authorization

14. Step 2. Tricks victim into visiting authorization URI specially crafted for
nefarious purposes (attacker specifies the callback).

15. Step 3. User enters their credentials at the authorization page,
unwittingly authorizing the attacker's request token. User is redirected to
a URI determined by the attacker.

16. Step 4. Attacker completes the OAuth workflow. Has access to the victim's
protected resources.

17. Step 5. $$$

18. The Result
Inconsistent implementations.
Different fixes for older providers.
Be aware.

19. OAuth 1.0a Protocol Overview

21. Endpoint URIs
Request Token URL
User Authorization URL
Access Token URL

22. Request a Request Token

23. Example: Twitter
Request:
POST /oauth/request HTTP/1.1
Host: local.eval.ca:8000
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3
...
Content-Type: application/x-www-form-urlencoded
Authorization: OAuth realm="", oauth_nonce="79013965", oauth_timestamp="1275364485",
oauth_consumer_key="TgF80q20x4j4kPRTiYJOXQ", oauth_signature_method="HMAC-SHA1",
oauth_version="1.0", oauth_signature="PmA%2FUWGZSN%2B%2FYZ0ak4yHAtT7in8%3D"
Response:
oauth_token=ZABxRSmYFX9oLsZOTfMbYlDXldtKuVARFkjfPjsJbT0&
oauth_token_secret=YGgcxX60kCHyoGiO2LhE0gfWXxZyJQnfBzpp64djykU

24. Example: FreshBooks
Request:
Authorization: OAuth realm="", oauth_nonce="92490670", oauth_timestamp="1275365018",
oauth_consumer_key="oauthprovider", oauth_signature_method="PLAINTEXT",
oauth_version="1.0", oauth_signature="mVASHE5wd8MiyJYYyRhpCpLVtfAyjm7qS%26",
oauth_callback="http%3A%2F%2Flocal.eval.ca%3A8000%2Foauth%2Fcallback%2F"
Response:
oauth_token=YzjQJppbHMuSL2bwSCvysH6vDtmV6R7r2&
oauth_token_secret=gFYjmhWZawhRdXzE4hpLeFtQR4B72znAh&
oauth_callback_confirmed=true

25. Redirect user to Authorization URI
Twitter:
http://twitter.com/oauth/authorize?oauth_token=UVENq7xUrdkE5dVu8AdrG1oETE3EMb5LVaUXZp0Nsy8
FreshBooks:
https://subdomain.freshbooks.com/oauth/oauth_authorize.php?oauth_token=UVENq7xUrdkE5dVu8AdrG1oETE3EMb5LVaUXZp0Nsy8

26. Handle Callback
Twitter:
http://yourapp.com/oauth/callback?oauth_token=UVENq7xUrdkE5dVu8AdrG1oETE3EMb5LVaUXZp0Nsy8
FreshBooks:
http://yourapp.com/oauth/callback?oauth_token=UVENq7xUrdkE5dVu8AdrG1oETE3EMb5LVaUXZp0Nsy8
&oauth_verifier=zzUWbPe1nOYkG9dzb8nm9X7t6gzbjW4l9kIAeRLQs

27. Exchange authorized Request
Token for Access Token

28. Example: Twitter
Request:
Authorization: OAuth realm="", oauth_nonce="83131550", oauth_timestamp="1275364497",
oauth_consumer_key="TgF80q21yvq4kPRWiYJOXQ", oauth_signature_method="HMAC-SHA1", oauth_version="1.0",
oauth_token="ZABxRSmYFX9oLsZOTfMbYlDXldtKuVARFkjfPjsJbT0",
oauth_signature="K1J5Q7TgU2S81FDLcDHrscRazGM%3D"
Response:
oauth_token=149686823-pX5PrnZ0bus8r7bzaA1tGlp3qQgud96eueauIioo&
oauth_token_secret=BWZ5riq707pP4gpb8dRguD2NmhSiHt7XdA1O99YGGI&
user_id=149686823&screen_name=freshnotifydemo

29. Example: FreshBooks
Request:
Authorization: OAuth realm="", oauth_nonce="56679057", oauth_timestamp="1275365024",
oauth_signature_method="PLAINTEXT", oauth_consumer_key="oauthprovider",
oauth_verifier="uuiDvKeqk3NX4P4wYvtYiPQdt9J5dB4sr", oauth_version="1.0",
oauth_token="YzjQJppbHMuSL2bwSCvysH6vDtmV6R7r2",
oauth_signature="mVASHE5wd8MiyJYYyRhpCpLVtfAyjm7qS%26gFYjmhWZawhRdXzE4hpLeFtQR4B72znAh"
Response:
oauth_token=yF53TK3Ya6eQdWPNWLuZZTviHWZaKXLrh&oauth_token_secret=UCrmxWriVsyD69URtQd6u7NQxFhiTpXBW

30. Accessing a Protected Resource

31. Example: Twitter
Request:
POST /1/statuses/update.json HTTP/1.1
...
Content-Type: application/x-www-form-urlencoded
Authorization: OAuth realm="", oauth_nonce="46002159", oauth_timestamp="1275366995",
oauth_consumer_key="TgF80q21yvq4kPRWiYJOXQ", oauth_signature_method="HMAC-SHA1", oauth_version="1.0",
oauth_token="149686823-pX5PrnZ0bus8r7bzaA1tGlp3qQgud96eueauIioo",
oauth_signature="bfvQGgVVL8EQ15KiGKN8WQHVhts%3D"
status=Ohai.
Response:
{ a lot of JSON }

32. Example: FreshBooks
Request:
POST /api/2.1/xml-in HTTP/1.1
...
Content-Type: application/xml
Authorization: OAuth realm="", oauth_nonce="56679057", oauth_timestamp="1275365024",
oauth_signature_method="PLAINTEXT", oauth_consumer_key="oauthprovider",
oauth_verifier="uuiDvKeqk3NX4P4wYvtYiPQdt9J5dB4sr", oauth_version="1.0",
oauth_token="YzjQJppbHMuSL2bwSCvysH6vDtmV6R7r2",
oauth_signature="mVASHE5wd8MiyJYYyRhpCpLVtfAyjm7qS%26gFYjmhWZawhRdXzE4hpLeFtQR4B72znAh"
<request method="invoice.list" />
Response:
<response status="ok">
A bunch of XML
</response>

33. Common Questions
What about Desktop & Mobile applications?
What the heck is OAuth WRAP?
What does OAuth have to do with OpenID?
What is up with OAuth 2?

34. OAuth 2.0

35. Problems with OAuth 1.0
Complex cryptographic requirements
Poor user experience for desktop / mobile
Performance at scale

36. OAuth 2.0
OAuth 2.0 defines authorization flows.
User Delegation Flows
Direct Credentials Flows
Autonomous Flows

37. User Delegation Flows
User-Agent Flow
Web Server Flow
Device Flow

38. Direct credentials Flows
Username and Password Flow
Client Credentials Flow

39. Autonomous flows:
Assertion Flow

40. OAuth 2.0
Bearer tokens over SSL
Simpler signatures
Short lived tokens with refresh tokens
Authorization server and resource server

41. Progress

42. OAuth 2.0 is currently in its 5th version of an IETF Draft.

43. There are implementations in the wild including Facebook, 37 Signals
and Github.

44. There are Objective C, Python and Ruby libraries available with varying
degrees of completeness.

45. So things are looking good, but as always when working with something
this new...

47. Resources
http://oauth.net/
http://tools.ietf.org/html/rfc5849
http://hueniverse.com/oauth/
http://tools.ietf.org/html/draft-ietf-oauth-v2-07

49. thank you!
Paul Osman
paul@eval.ca