Modern Single Sign-On: On the Security of Single Sign-On ...
summary
Claims that modern SSO flows in popups and iframes expose new web-attack surfaces: three practical bug classes—wildcard receiver, malicious receiver, and malicious initiator—lead to token leakage, session swapping, or account linking. A Chrome-extension analyzer captures and reconstructs flows (example run records ~1,600 in-browser messages) and produces PoCs that exploit Alibaba’s relay popup; fixes include hard-coded origins, stricter regex checks, and JavaScript origin validation. Also demonstrates using Intersection Observer v2 to mitigate hidden-click attacks.
AI-written summary · about
chapters (14)
- 0:00Introduction to modern Single Sign-On
- 1:50SSO flow basics
- 3:14What is SSO
- 4:18Textbook SSO flow
- 7:31Popup and iframe SSO flows
- 9:39Cross-origin communication
- 13:54SSO security threats
- 14:37Wildcard receiver attacks
- 17:51Malicious initiator attack
- 19:37Clickjacking in iframes
- 22:27Real-world vulnerabilities found in the wild
- 27:46SSO tool demo
- 37:00SSO research lessons
- 39:06Closing & Q&A
related talks
22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On
30mOMG WTF SSO: A Beginner’s Guide to Single Sign-On...
30mSingle Page Applications: Is your design secure?
57mThe insecurity of OAuth 2.0 in frontends
58mExploiting web messaging implementations
37mThe Seven Deadly Sins of Web Apps, or a Bit About SSO Bugs
43mAttacking Modern Web Technologies
50mSecure Authentication and Session Management