An Authorization Framework with OAuth for FinTech Servers

Göçer B. D., BAHTİYAR Ş.

2019 4th International Conference on Computer Science and Engineering (UBMK), Samsun, Türkiye, 11 - 15 Eylül 2019, ss.536-541 identifier identifier

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Doi Numarası: 10.1109/ubmk.2019.8907182
  • Basıldığı Şehir: Samsun
  • Basıldığı Ülke: Türkiye
  • Sayfa Sayıları: ss.536-541
  • Anahtar Kelimeler: Authorization, OAuth, FinTech, Security, Vulnerability
  • İstanbul Teknik Üniversitesi Adresli: Evet

Özet

OAuth is used by many FinTech applications for authorization purposes and there are many implementations of OAuth protocol. Some of the implementations do not implement OAuth specifications correctly. This creates critical vulnerabilities on the FinTech applications that circumstances give rise a negative impact on FinTech companies. In this paper, we have analyzed 18 authorization servers that are used by FinTech applications. We have selected and analyzed resource servers (more than 100 applications) that use these OAuth servers to find their vulnerabilities. We have found some vulnerabilities on the flow of OAuth implementations. We propose a framework to reduce the implementation vulnerabilities on the flow. Our analyses results show that the proposed framework will help developers to reduce the most common vulnerabilities on OAuth flow.