Provide nonce protection for replay attacks

sadilchamishka commented 1 year ago

Proposed changes in this pull request

The nonce based replay attack protection is provided from the OIDC federated authenticators.

The replay attack

The authorization code flow of the federated authentication flow is targeted in this attack. As shown in the below figure, the authorization code response which is redirected to the authorization server (highlighted in red) can be hijacked and even block the redirection. Then the potential attacker can continue complete authorization flow from the beginning but without completing step 5, and play a redirection to the authorization server including the hijacked auth code of the victim.

Screenshot 2023-04-25 at 13 10 43

The authorization flow is exposed to this type of attack due to not being able to prove the authorization request sender (redirection of step 3) is the same as the auth code receiver (step 6) for that corresponding authorization request.
Attack complexity is high due to the attacker having to intercept the auth code in step 06 and drop the redirection. The attacker can intercept the redirection and fetch the auth code as it is sent as a query param. Then if he succeeds in reaching the authorization server before the victim's request, the attacker can exploit.