[
https://issues.apache.org/jira/browse/GUACAMOLE-1434?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17424779#comment-17424779
]
Mike Jumper commented on GUACAMOLE-1434:
----------------------------------------
Including the ID token within the URL is actually how the OpenID Connect
"implicit flow" works. It is required by the OpenID spec that the IDP include
the "id_token" within the query parameters of the URL when redirecting the user
back to the application.
Once that ID token has been used by the application, there is no risk of reuse.
The token actually contains a copy of a nonce that Guacamole originally
generated when requesting authentication. If the same token were somehow copied
and used again, Guacamole would reject it. The same goes if the token were
copied and given to another application or another instance of Guacamole (the
nonce would not match).
See:
https://github.com/apache/guacamole-client/blob/754e9649f1fa0ba225ee42b56ded64bc283d17df/extensions/guacamole-auth-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java#L96-L111
> OpenId - ID_token is visible in web URL
> ----------------------------------------
>
> Key: GUACAMOLE-1434
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-1434
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole-auth-openid
> Affects Versions: 1.3.0
> Reporter: kathiresh
> Priority: Minor
> Labels: security
> Attachments: Guacamole_id_token.png
>
>
> Hi Team,
>
> When we authenticate the Guacamole application using the openID auth,
> *Id_token* is clearly appearing in web URI. I feel it's security risk.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
