Unified Singular Protocol Flow for OAuth (USPFO) Ecosystem
Jaimandeep Singh, Naveen Kumar Chaudhary

TL;DR
This paper introduces USPFO, a unified OAuth protocol flow that enhances security and usability by combining client and grant types, reducing vulnerabilities, and maintaining compatibility with existing standards.
Contribution
It proposes a novel unified OAuth flow that supports all client types, improving security and simplifying implementation compared to traditional separate flows.
Findings
Reduces OAuth vulnerabilities like impersonation and token theft.
Provides compatibility with existing OAuth standards.
Enhances security through integrity and audience binding.
Abstract
OAuth 2.0 is a popular authorization framework that allows third-party clients such as websites and mobile apps to request limited access to a user's account on another application. The specification classifies clients into different types based on their ability to keep client credentials confidential. It also describes different grant types for obtaining access to the protected resources, with the authorization code and implicit grants being the most commonly used. Each client type and associated grant type have their unique security and usability considerations. In this paper, we propose a new approach for OAuth ecosystem that combines different client and grant types into a unified singular protocol flow for OAuth (USPFO), which can be used by both confidential and public clients. This approach aims to reduce the vulnerabilities associated with implementing and configuring different…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsWeb Application Security Vulnerabilities · IPv6, Mobility, Handover, Networks, Security · Advanced Malware Detection Techniques
