Skip to Main content Skip to Navigation
Conference papers

From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?

Abstract : Browser-based Single Sign-On (SSO) is replacing conventional solutions based on multiple, domain-specific credentials by offering an improved user experience: clients log on to their company system once and are then able to access all services offered by the company’s partners. By focusing on the emerging SAML standard, in this paper we show that the prototypical browser-based SSO use case suffers from an authentication flaw that allows a malicious service provider to hijack a client authentication attempt and force the latter to access a resource without its consent or intention. This may have serious consequences, as evidenced by a Cross-Site Scripting attack that we have identified in the SAML-based SSO for Google Apps: the attack allowed a malicious web server to impersonate a user on any Google application. We also describe solutions that can be used to mitigate and even solve the problem.
Document type :
Conference papers
Complete list of metadata

Cited literature [14 references]  Display  Hide  Download
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Monday, July 24, 2017 - 10:40:19 AM
Last modification on : Wednesday, May 19, 2021 - 4:52:03 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Alessandro Armando, Roberto Carbone, Luca Compagna, Jorge Cuellar, Giancarlo Pellegrino, et al.. From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?. 26th International Information Security Conference (SEC), Jun 2011, Lucerne, Switzerland. pp.68-79, ⟨10.1007/978-3-642-21424-0_6⟩. ⟨hal-01567599⟩



Record views


Files downloads