Repository navigation
How to mitigate the security flaw created by the fact that a session is created _before_ a token was granted? #44497
Unanswered
ericmorand
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Using the Authorization Flow, whenever a end-user is redirected to the Keycloak authentication form and fills sucessfully their username and password, a session is created, and the browser is redirected with an authorization code as query parameter. The relying party then attempts to get a token from the authorization code, which may or may not be successful.
But, regardless of the success of this token retrieval, there is a session in the Keycloak server for the end-user. And from that point, whenever the end-user is redirected to the Keycloak authentication form, they gets authenticated.
Isn't it a big security flaw?
Let's say that the end-user changes the client ID in the URL of the authentication form, and replace it with a client ID that is less constrained - typically one that does not require MFA. A session is then created. The relying party fails to retrieve a token, because the code was generated for a client that is not the client that the relying party executes the token endpoint with, and Keycloak answers with a 400 response in this situation:
Sounds good. Except it is not good. Since the session was created as soon as the end-user filled its username and password successfully, they are now considered as logged-in and SSO applies. Basically, they were able to use a less-constrained client to be granted access to any client.
How can we mitigate this problem?
Shouldn't Keycloak create a session only when a code was successfully exchanged for a token?
Or is the whole "custom flow per client" something that we should avoid using?
Note that I'm sure I'm missing something obvious here.
All reactions