English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

OAuth is the new de facto standard for delegating authorization in the web.An important limitation of OAuth is the fact that it was designed forauthorization and not for authentication. The usage of OAuth for authenticationthus leads to serious vulnerabilities as shown by Zhou et. al. in [44] and Chenet. al. in [9]. OpenID Connect was created on top of OAuth to fill this gap byproviding federated identity management and user authentication. OpenID Connectwas standardized in February 2014, but leading companies like Google,Microsoft, AOL and PayPal are already using it in their web applications [1],[2], [3], [30].  In this paper we describe the OpenID Connect protocol and provide the firstin-depth analysis of one of the key features of OpenID Connect: the Discoveryand the Dynamic Registration extensions.We present a new class of attacks onOpenID Connect that belong to the category of second-order vulnerabilities.These attacks consist of two phases: First, the injection payload is stored bythe legitimate application. Later on, this payload is used in asecurity-critical operation. Our new class of attacks - called MaliciousEndpoints attacks - exploits the OpenID Connect extensions Discovery andDynamic Registration. These attacks break user authentication, compromise userprivacy, and enable Server Side Request Forgery (SSRF), client-side codeinjection, and Denial-of-Service (DoS). As a result, the security of the OpenIDConnect protocol cannot be guaranteed when these extensions are enabled intheir present form.  We contacted the authors of the OpenID Connect and OAuth specifications. Theyacknowledged our Malicious Endpoint attacks and recognized the need to improvethe specification [29]. We are currently involved in the discussion regardingthe mitigation of the existing issues and an extension to the OAuthspecification.

On the security of modern Single Sign-On Protocols: Second-Order Vulnerabilities in OpenID Connect