Making Google OAuth interactions safer through the use of safer OAuth flows

Posted by Vikrant Rana, Product Supervisor and Badi Azad, Group Product Supervisor, Google

At Google, we always try to supply safer methods for customers to sign-in and share their Google account information with third-party functions. Within the spirit of that work, we can be rolling out a set of protections towards phishing and app impersonation assaults through the OAuth interactions.

The Google sign-in and authorization flows are powered by the Google OAuth platform and over time we’ve developed and supported plenty of methods for app builders to combine with supported OAuth flows. With the purpose of protecting customers safer on-line, we are going to finish assist for 2 legacy flows and would require builders emigrate to different implementation strategies that supply better protections.

To make sure a easy transition and keep away from any service interruption we are going to give ample time to implement and meet the compliance dates that are specified under. We are going to share additional updates on this rollout through e-mail so please be certain that your assist e-mail handle is updated in undertaking settings on the Google API console.

The Loopback IP handle stream is susceptible to man within the center assault the place a malicious app, accessing the identical loopback interface on some working methods, could intercept the OAuth response and acquire entry to the authorization code. We intend to take away this menace vector by disallowing this stream for iOS, Android and Chrome app OAuth shopper sorts. The prevailing purchasers will be capable of migrate to extra safe implementation strategies. New purchasers can be unable to make use of this stream beginning on March 14, 2022.

What do I have to do

Decide in case your app is utilizing the Loopback IP handle stream

You’ll be able to examine your app code or the outgoing community name (in case your app is utilizing an OAuth library) to find out if the Google OAuth authorization request your app is making has the next values for “redirect_uri” parameter.

redirect_uri=http://127.0.0.1:port or http://[::1]:port”>http://[::1]:port or

http://localhost:port

Migrate to an alternate stream

In case your app is utilizing the Loopback IP handle technique you could migrate to a different technique which is safer by default. Please contemplate the next different strategies for migration.

Key dates for compliance

• Mar 14, 2022 – new OAuth utilization can be blocked for the Loopback IP handle stream
• Aug 1, 2022 – a user-facing warning message could also be exhibited to non-compliant OAuth requests one month earlier than the compliance date
• Aug 31, 2022 – the Loopback IP handle stream is blocked for present purchasers

OAuth out-of-band (OOB) is a legacy stream developed to assist native purchasers which don’t have a redirect URI like internet apps to just accept the credentials after a consumer approves an OAuth consent request. The OOB stream poses a distant phishing danger and purchasers should migrate to an alternate technique to guard towards this vulnerability. New purchasers can be unable to make use of this stream beginning on Feb 28, 2022.

What do I have to do

Decide in case your app is utilizing the OOB stream

You’ll be able to examine your app code or the outgoing community name (in case your app is utilizing an OAuth library) to find out if the Google OAuth authorization request your app is making has the next values for “redirect_uri” parameter.

redirect_uri=urn:ietf:wg:oauth:2.0:oob or urn:ietf:wg:oauth:2.0:oob:auto or oob

Migrate to an alternate stream

In case your app is utilizing the OOB technique you could migrate to a different technique which is safer by default. Please contemplate the next different strategies for migration.

Key dates for compliance

• Feb 28, 2022 – new OAuth utilization can be blocked for the OOB stream
• Sep 5, 2022 – a user-facing warning message could also be exhibited to non-compliant OAuth requests
• Oct 3, 2022 – the OOB stream is deprecated for present purchasers

A user-facing warning message could also be displayed for non-compliant requests one month earlier than the aforementioned OAuth strategies are as a result of be blocked. The message will convey to the customers that the app could also be blocked quickly whereas displaying the assist e-mail that you’ve got registered within the OAuth consent display screen in Google API Console.

[Sample user-facing warning]

The builders can acknowledge the user-facing warning message and suppress it by passing a question parameter within the authorization name as proven under.

• Go to the code in your app the place you ship requests to Google’s OAuth 2.0 Authorization Endpoint.
• Add a parameter with a worth of the enforcement date
  • For OOB: Add an ack_oob_shutdown parameter with a worth of the enforcement date: 2022-10-03. Instance: ack_oob_shutdown=2022-10-03
  • For Loopback IP handle: Add an ack_loopback_shutdown parameter with a worth of the enforcement date: 2022-08-31. Instance: ack_loopback_shutdown=2022-08-31

If an app isn’t up to date to fulfill compliance by the required date the authorization requests can be blocked and customers could encounter an invalid request error display screen (pattern proven under).

[Sample user-facing error]