Name
Abstract | ||
|---|---|---|
The postMessage feature in HTML5 allows web components of different origins to communicate with each other. However, the message receivers do not differentiate the origins of a message, making information leakage possible. Being aware of this vulnerability, We examine its implication under the context of Single Sign On (SSO) mechanism. Nowadays, many websites integrate SSO to facilitate easier user authentication by relying on an identifier provider such as Facebook to provide the identity of a user. However, many websites with SSO log-on rely on postMessage to transmit the Access Token. We identify the problem and demonstrate that any postMessage Receiver on this web page can eavesdrop on the token and hijack the user account. As a result, significant information leakage and account takeover are likely to happen. |
Year | DOI | Venue |
|---|---|---|
2017 | 10.1109/PAC.2017.30 | 2017 IEEE Symposium on Privacy-Aware Computing (PAC) |
Keywords | Field | DocType |
OAuth,postMessage | Single sign-on,Access token,Authentication,Web page,Identifier,Information leakage,Computer security,Computer science,Information privacy,Security token | Conference |
ISBN | Citations | PageRank |
978-1-5386-1028-2 | 0 | 0.34 |
References | Authors | |
1 | 3 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Chong Guan | 1 | 5 | 1.42 |
| Yue Li | 2 | 14 | 4.99 |
| Kun Sun | 3 | 142 | 12.80 |