diff --git a/lws10-core/Security-Considerations.html b/lws10-core/Security-Considerations.html index abf51be..c233778 100644 --- a/lws10-core/Security-Considerations.html +++ b/lws10-core/Security-Considerations.html @@ -1,66 +1,33 @@ -
-

Authentication Security

+

+ The recommendations described in Best Current Practice for OAuth 2.0 Security [[RFC9700]] apply to this specification. +

-

- All communications related to requesting, retrieving and presenting end-user credentials between clients and servers must use TLS-protected connections. -

+
+

Transport Security

-

-End-user credentials are vulnerable to theft and replay. Tokens should have a reasonably short lifetime, such as 3600 seconds (1 hour). -

- -

-Clients that persist end-user credentials must take great care to store these tokens securely. Tokens should never be stored unencrypted in a browser's localStorage, in URLs or in logs. -

+

+ Transport Layer Security (TLS) is an important mechanism to prevent against tampering, spoofing, and information disclosure. TLS-protected communication can be verified according to [[RFC6125]]. + Implementation security considerations can be found in "Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)" [[BCP195]]. +

-
-

Authorization Security

+
+

Token Security

- The recommendations described in Best Current Practice for OAuth 2.0 Security [[!RFC9700]] apply to this specification. + Bearer tokens and digital credentials are vulnerable to theft and replay. Mitigations include using a reasonably short lifetime, binding tokens to a particular audience, and storing tokens securely.

-
-

Transport Security

- -

- An Authorization Server implementation MUST support TLS. When using TLS, the client MUST perform a TLS/SSL server certificate check, per RFC 6125 [[!RFC6125]]. - Implementation security considerations can be found in "Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)" [[!BCP195]]. -

-
- -
-

Token Security

- -

- Bearer tokens are vulnerable to theft and replay. Required mitigations include: -

- -
    -
  • - Short Lifetimes: Tokens SHOULD have lifetimes of 300 seconds (5 minutes) or less -
    • -
  • - Audience Binding: Tokens MUST be bound to a specific storage server via the aud claim -
    • -
  • - Secure Storage: Clients MUST store tokens securely in memory when possible, never in localStorage, URLs, or logs -
    • -
-
- -
-

End-User Credential Protection

- -

- End-user credentials with unrestricted audiences MUST NOT be provided to untrusted authorization servers. -

- -

- If an end-user credential issuer is unable to restrict the audience of a token, clients SHOULD use a mechanism - such as OAuth 2.0 Token Exchange [[!RFC8693]] to create audience-restricted credentials before interacting with authorization servers. -

-
+
    +
  • + Short Lifetimes: authorization servers that assign lifetimes of 300 seconds (5 minutes) or less to access tokens can limit the potential exposure of an exfiltrated credential. +
    • +
  • + Audience Binding: access tokens that are bound to a specific destination server, such as via the aud claim, can rely on that binding to protect against token replay. Applications that handle credentials with an unrestricted audience need to be careful when sending these credentials to other entities, especially untrusted authorization servers. If a credential issuer is unable to restrict the audience of a token, clients can use a mechanism such as OAuth 2.0 Token Exchange [[RFC8693]] to create audience-constrained credentials before interacting with an authorization server in a different security domain. +
    • +
  • + Secure Storage: applications that persist credentials need to ensure that these objects are stored safely. Any time an unencrypted token is stored in a browser's localStorage, in URLs, or in logs, that token is more susceptible to an exfiltration attack. +
    • +
diff --git a/lws10-core/index.html b/lws10-core/index.html index 3ca2069..9409e37 100644 --- a/lws10-core/index.html +++ b/lws10-core/index.html @@ -335,7 +335,7 @@

Portability Considerations

-
+

Security Considerations

Formal security considerations section covering threat models, security requirements, and implementation guidance for secure LWS deployments.