Post #3528505

2026-07-02 06:26 UTC

Good morning Europe I have written about the bewildering array of mechanisms available to prevent authentication token theft and also explained why we still basically have none of them available and so the authentication tokens are still being stolen and used. It is here: https://www.codon.org.uk/~mjg59/blog/p/preventing-token-theft/

Replies (2)

@jamesh@aus.social 2026-07-02 10:54

@mjg59@nondeterministic.computer I imagine some of the pushback on TLS based solutions is that it is that getting it to work if you've e.g. decided to let Cloudflare MITM your connections or use some other service to terminate the TLS connections. If that frontend doesn't support the feature or doesn't pass through the relevant info, you're screwed. I also wonder if the difficulties with OAuth 1.0 tilted people towards simple bearer tokens. I remember having a lot of difficulty with Apache normalising requests in ways that would break signatures by the time the application saw the request. It was bad enough to just recomend people use PLAINTEXT mode. That feels like it directly leads to OAuth 2.0 only defining bearer tokens at launch.

Open ##3535048
@xssfox@cloudisland.nz 2026-07-02 22:41

@mjg59@nondeterministic.computer surely high risk targets like GHA and AWS have implemented... nevermind

Open ##3544611