The OAuth login might not be safe

[chemwolf6922]

Describe the Bug / 描述问题

Here are some thoughts on how this plugin's OAuth login might be attacked by a device at the same LAN.

Facts

1. The registered OAuth redirect URL a .local URL, which is resolved via mDNS.
2. The oAuth client id is public.

Assumptions

1. The user does not protect their ha server with valid https.
2. The user accesses ha from another device than the ha server.

Proposed attack

1. A device in the same LAN forcefully broadcasts the same mDNS address. Overwriting ha's.
2. The user accesses ha's web app via the mDNS address, calls the attacker's device, and fails.
3. The user then accesses ha's web app via IP.
4. The user logins into this plugin via OAuth.
5. The OAuth server tells the user's browser to access the mDNS address with the valid token.
6. The browser actually calls the attacker device and pass the token to it.
7. Since the app id is public. The attacker will be able to access the user's account.
8. The user will just take this as a login failure and try again.

I have not verified this by doing a real attack. But IMHO this attack might be feasible. And might be a lot easier than hijacking the http content.

Proposed mitigations

1. Let the user see what/how many tokens are active in their mi home app. And able to revoke them. (However, damage might already be done by this point)
2. Do the OAuth login from the ha server side. With a 127.0.0.1 redirect URL. (might require the server to have a GUI and browser).
3. Ditch OAuth and use something similar what vs code tunnel does for login (from the ha server side with a pin code.).

How to Reproduce / 复现步骤

N/A

Expected Behavior / 预期结果

N/A

Reproduce Time / 问题复现的时间点

N/A

Home Assistant Logs / 系统日志

N/A

Log Timezone / 日志时区

N/A

Home Assistant Core Version / Home Assistant Core 版本

N/A

Home Assistant Operation System Version / Home Assistant Operation System 版本

N/A

Xiaomi Home Integration Version / 米家集成版本

N/A

Additional Context / 其他说明

No response

[SusanPhevos]

The attacker's device should be in the same LAN with Home Assistant. The router's password must be cracked first. So the risk is limited.
Users can revoke the OAuth token through Xiaomi Home APP -> Profile -> Click your username and get into Xiaomi Account management page -> Basic info: Apps -> Xiaomi Home (Home Assistant Integration) -> Remove
It is a good suggestion to display how many tokens are active. I have passed this suggestion on to the Xiaomi Home App development team, Xiaomi Account department and the Security and Privacy Committee.