Authentication Token In URL

[sveeke]

A user retrieves an Authentication Token after a successful login. In some requests this token is leaked in the GET parameter and are vulnerable to disclosure.

[sveeke]

threatLevel="Moderate" type="Information Leak"

The server uses authentication tokens to grant a user access to a resource.

Example request with authentication token "5a29a471f3b21be11928361f5c42aeabf0c5cd8f":

GET /v1/user/emails HTTP/1.1
Host: badgr-dev2.edubadges.nl
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Token 5a29a471f3b21be11928361f5c42aeabf0c5cd8f
Referer: https://surf-dev2.edubadges.nl/profile/profile
Origin: https://surf-dev2.edubadges.nl
Connection: close

The authentication token is sent in the following GET requests:

https://oidc.connect.surfconext.nl/authorize?scope=openid&state=connect-5a29a471f3b21be11928361f5c42aeabf0c5cd8f-1&redirect_uri=https%3A%2F%2Fbadgr-dev2.edubadges.nl%2Faccount%2Fopenid%2Flogin%2Fcallback%2F&response_type=code&client_id=https%40%2F%2Fsurf-dev2.edubadges.nl

https://badgr-dev2.edubadges.nl/account/sociallogin?provider=surf_conext&authToken=5a29a471f3b21be11928361f5c42aeabf0c5cd8f

Sensitive information within URLs may be logged in various locations
(including the browser), the web server, and any forward or reverse proxy
servers between the two endpoints. URLs may also be displayed on-screen,
bookmarked or emailed around by users. They may be disclosed to third
parties via the Referer header when any off-site links are followed.

impact:
Authentication tokens allow an attacker unfettered access to the application as the
logged-in user.

Recommendation
When authentication tokens need to be sent using other means than cookies, use an
alternative mechanism, e.g. sending tokens in hidden form fields using the
POST method.

[ottonomy]

Did you configure your badgr-server to run in "Public" mode instead of "Confidential" mode on your SSO provider's applicaiton configuration system? Or perhaps it should just be upgraded to make more secure options available to you. Ideally with a Authorization Code OAuth grant type the system sends a short-term access "code" in the query parameter that is then exchanged for a longer term token with potential refreshability over a secure connection.