<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://19/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">We want the implicit flow to validate nonce, it would be better to have some reasonable advice for using HTML local storage rather than session cookies.<div><br><div><div>On 2013-10-24, at 3:44 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">We could drop it from the Implicit Flow, as it’s already present in the Code Flow. Does that work for people?<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> -- Mike<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Richer, Justin P. [mailto:jricher@<a href="http://mitre.org">mitre.org</a>]<span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, October 24, 2013 12:56 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Mike Jones<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] Nonce value suggestion for the Implicit Flow<o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">I'm actually in favor of dropping this example, or else providing it in a list of alternatives. The important thing is that the client can validate the exact value of the nonce parameter on its way back through, the mechanics of how that happens are client specific (but we can provide simple guidance).<o:p></o:p></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> -- Justin<o:p></o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">On Oct 24, 2013, at 11:44 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline; ">Michael.Jones@microsoft.com</a>><o:p></o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> wrote:<o:p></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br><br><o:p></o:p></div><div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">For the Implicit Flow, the “nonce” description contains this text at<a href="http://openid.bitbucket.org/openid-connect-core-1_0.html#ImplicitAuthorizationRequest" style="color: purple; text-decoration: underline; "><span style="color: purple; ">http://openid.bitbucket.org/openid-connect-core-1_0.html#ImplicitAuthorizationRequest</span></a>:<o:p></o:p></span></div></div><div style="margin-left: 0.5in; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; ">Sufficient entropy MUST be present in the<span class="apple-converted-space"> </span></span><tt style="font-family: 'Courier New'; "><span lang="EN" style="color: rgb(0, 51, 102); ">nonce</span></tt><span class="apple-converted-space"><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; "> </span></span><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; ">values used to prevent attackers from guessing values.<span class="apple-converted-space"> </span><span style="background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">One method to achieve this is to store a random value as a signed session cookie, and pass the value in the</span></span><tt style="font-family: 'Courier New'; "><span lang="EN" style="color: rgb(0, 51, 102); background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">nonce</span></tt><span class="apple-converted-space"><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; background-color: yellow; background-position: initial initial; background-repeat: initial initial; "> </span></span><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">parameter. In that case, the<span class="apple-converted-space"> </span></span><tt style="font-family: 'Courier New'; "><span lang="EN" style="color: rgb(0, 51, 102); background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">nonce</span></tt><span class="apple-converted-space"><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; background-color: yellow; background-position: initial initial; background-repeat: initial initial; "> </span></span><span lang="EN" style="font-size: 11pt; font-family: Verdana, sans-serif; background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">in the returned ID Token can be compared to the signed session cookie to detect ID Token replay by third parties.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">George wrote this about the suggestion in his review:<o:p></o:p></span></div></div><div style="margin-left: 0.5in; "><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">“I'm not sure this suggestion makes sense for the implicit flow. The client would need to write a cookie value on the domain of the redirect_uri and the attempt to read it on the return of the implicit flow. Wondering if a local storage example would make more sense.”<o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Do people agree with him? If so, does someone want to supply specific alternative text to use?<o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> -- Mike<o:p></o:p></span></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 13.5pt; font-family: Helvetica, sans-serif; ">_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline; "><span style="color: purple; ">Openid-specs-ab@lists.openid.net</span></a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline; "><span style="color: purple; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a><o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab</div></blockquote></div><br></div></body></html>