()
| 3993 | } |
| 3994 | |
| 3995 | @Override |
| 3996 | public String getIssueBackground() |
| 3997 | { |
| 3998 | return "OAUTHv2 is an open standard that allows applications to get access to protected " |
| 3999 | +"resources and APIs on behalf of users without accessing their credentials.\n " |
| 4000 | +"OAUTHv2 defines overarching schemas for granting authorization but does not describe how " |
| 4001 | +"to actually perform authentication.\nOpenID instead is an OAUTHv2 extension which strictly defines some " |
| 4002 | +"authentication patterns to grant access to users by authenticating them through another service " |
| 4003 | +"or provider.\n " |
| 4004 | +"There are many different ways to implement OAUTHv2 and OpenID login procedures. They are widely " |
| 4005 | +"supported by identity providers and API vendors and could be used in various contexts" |
| 4006 | +"(as for Web, Mobile, Native desktop applications, etc.).\n " |
| 4007 | +"Cause of their complexity and versatility, OAUTHv2 and OpenID are both extremely common " |
| 4008 | +"and inherently prone to implementation mistakes, and this can result in various kind of " |
| 4009 | +"vulnerabilities, which in some cases could allow attackers to obtain reserved data and/or " |
| 4010 | +"potentially completely bypass authentication."; |
| 4011 | } |
| 4012 | |
| 4013 | @Override |
| 4014 | public String getRemediationBackground() |
nothing calls this directly
no outgoing calls
no test coverage detected