search

p2 / OAuth2

OAuth2 framework for macOS and iOS, written in Swift.
Other
1.14k stars 275 forks source link

Added requestUsingIDToken configuration #406

Open ddaddy opened 1 year ago

ddaddy commented 1 year ago

Fixes #405 as it allows the use of the id_token instead of the access_token when signing requests. This is handy when using AWS Cognito with AWS API Gateway.

jozefizso commented 5 months ago

I don't think this is a good change.,

The ID token should not be used for authentication.

As said above, an ID token proves that a user has been authenticated. In a first-party scenario, i.e. in a scenario where the client and the API are both controlled by you, you may decide that your ID token is good to make authorization decisions: maybe all you need to know is the user identity.

However, even in this scenario, the security of your application, consisting of the client and the API, may be at risk. In fact, there is no mechanism that ties the ID token to the client-API channel. If an attacker manages to steal your ID token, they can use it to call your API like a legitimate client.

If your API accepts an ID token as an authorization token, to begin with, you are ignoring the intended recipient stated by the audience claim. That claim says that it is meant for your client application, not for the resource server (i.e., the API).

You may think this is just a formality, but there are security implications here.

https://auth0.com/blog/id-token-access-token-what-is-the-difference/