Repository navigation
Replies: 1 comment 4 replies
|
@JoshuaMulliken it sounds interesting Josh, do you have any concrete examples of other projects? Or references? |
|
We could consider regex-based filtering using lists produced by a tool like akamai/luda. It could be similar to ModSecurity but more directly integrated. An MVP could be an always positive classifier that asks users for confirmation before forwarding them to their destination. It could be enabled by default if the client has a wildcard in the "Valid redirect URIs." |
|
Wouldn't you rather delegate this to some external system? For example to detect injection attacks, we have an Application Gateway Firewall that uses OWASP ruleset for checking. |
|
@sschu it could be done there, but I think there is a good amount of value to be had in the base case where we ask the user to look at the URL nice and hard before we forward them on (when there is a wildcard as a valid redirect URI). A WAF would only work on systems configured in front of it, so if keycloak forwards someone to another system, that one would be responsible for providing the protection. Since the redirect_uri parameter is URL encoded, most WAFs won't dive deep enough to detect an issue if it is only in front of Keycloak. |
|
Ah, I did not think about the URL-encoding... |
Uh oh!
There was an error while loading. Please reload this page.
I was reading #9278 and thinking about ways that we could help improve the security of clients that do not follow the best practices (like legacy or proprietary software that we can not update).
I was thinking that Keycloak could automatically detect potentially malicious redirect URIs (even if they pass validation against the "Valid redirect URIs") and provide additional information to the user before forwarding them to the destination.
We could by default provide a simple classifier and allow others to be created that take smarter approaches like machine learning.
Potential default classifiers:
httpsIf we detect a malicous URI we could show a page that displays the link that they will be sent to and ask them if they intended to go there. This would allow the classifier to be bypassed if it is a false positive. It could have a big red warning that says something like "We believe that this URL might be malicous. Please evaluate it carefully before proceeding"
What do you think of this idea? Is it feasible?
All reactions