10.15. 自由重定向器(10.15. Open Redirectors)

10.15. 自由重定向器

授权服务器、授权端点和客户端重定向端点可能被不当配置，被作为自由重定向器。自由重定向器是一个使用参数自动地向参数值指定而无任何验证的地址重定向用户代理的端点。

自由重定向器可被用于钓鱼攻击，或者被攻击者通过使用熟悉的受信任的目标地址的URI授权部分使最终用户访问恶意站点。此外，如果授权服务器允许客户端只注册部分的重定向URI，攻击者可以使用客户端操作的自由重定向器构造重定向URI，这将跳过授权服务器验证但是发送授权码或访问令牌给攻击者控制下的端点。

10.15. Open Redirectors

   The authorization server, authorization endpoint, and client
   redirection endpoint can be improperly configured and operate as open
   redirectors.  An open redirector is an endpoint using a parameter to
   automatically redirect a user-agent to the location specified by the
   parameter value without any validation.

   Open redirectors can be used in phishing attacks, or by an attacker
   to get end-users to visit malicious sites by using the URI authority
   component of a familiar and trusted destination.  In addition, if the
   authorization server allows the client to register only part of the
   redirection URI, an attacker can use an open redirector operated by



Hardt                        Standards Track                   [Page 60]

---

 
RFC 6749                        OAuth 2.0                   October 2012


   the client to construct a redirection URI that will pass the
   authorization server validation but will send the authorization code
   or access token to an endpoint under the control of the attacker.