{"action":"created","issue":{"url":"https://api.github.com/repos/auth0/meteor-auth0/issues/29","repository_url":"https://api.github.com/repos/auth0/meteor-auth0","labels_url":"https://api.github.com/repos/auth0/meteor-auth0/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/auth0/meteor-auth0/issues/29/comments","events_url":"https://api.github.com/repos/auth0/meteor-auth0/issues/29/events","html_url":"https://github.com/auth0/meteor-auth0/issues/29","id":165268753,"number":29,"title":"[Security issue] No server-side verification","user":{"login":"wallslide","id":917069,"avatar_url":"https://avatars.githubusercontent.com/u/917069?v=3","gravatar_id":"","url":"https://api.github.com/users/wallslide","html_url":"https://github.com/wallslide","followers_url":"https://api.github.com/users/wallslide/followers","following_url":"https://api.github.com/users/wallslide/following{/other_user}","gists_url":"https://api.github.com/users/wallslide/gists{/gist_id}","starred_url":"https://api.github.com/users/wallslide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wallslide/subscriptions","organizations_url":"https://api.github.com/users/wallslide/orgs","repos_url":"https://api.github.com/users/wallslide/repos","events_url":"https://api.github.com/users/wallslide/events{/privacy}","received_events_url":"https://api.github.com/users/wallslide/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-13T08:47:55Z","updated_at":"2016-07-20T20:25:14Z","closed_at":null,"body":"This project seems to just blindly trust the client. It uses the data received from the client, and uses that to build a meteor user without any server-side checking with auth0 whatsoever. This means that a knowledgeable person could log in as anybody if they knew that person's auth0 user_id.\r\n\r\nWe've modified the code from https://github.com/xcv58/meteor-auth0/tree/1.3/auth0-lock to prevent this.  Rather than using the profile passed from the client to verify/create a new user [here](https://github.com/auth0/meteor-auth0/blob/master/lock/auth0-lock.server.js#L37), we get the user's profile directly from auth0 using the token they pass in, thus verifying them and their profile in the process:\r\n\r\n```javascript\r\nimport {AuthenticationClient} from 'auth0'; // importing from npm repository\r\nconst {AUTH0_CLIENT_ID, AUTH0_DOMAIN} = Meteor.settings.public;\r\n\r\nconst auth0 = new AuthenticationClient({\r\n  domain: AUTH0_DOMAIN,\r\n  clientId: AUTH0_CLIENT_ID\r\n});\r\n\r\n//use a token to get the user's profile directly from auth0 instead of \r\n//trusting the data passed in by the user\r\nconst verifyTokenAndGetProfile = (token)=> {\r\n  return auth0.tokens.getInfo(token);\r\n};\r\n```\r\n\r\nand then later on\r\n\r\n```javascript\r\nexport const loginHandler = (options) => {\r\n  if (!options.auth0 || !options.auth0.token) {\r\n    // Do not handle\r\n    return undefined;\r\n  }\r\n\r\n//actually call the function, getting us the user-profile from auth0\r\nconst auth0Profile = Promise.await(verifyTokenAndGetProfile(options.auth0.token));\r\n\r\n.\r\n.\r\n.\r\n//finally use the profile received directly from auth0 to update/create the meteor user\r\nconst result = Accounts.updateOrCreateUserFromExternalService(\r\n    'auth0', auth0Profile, options.auth0.token\r\n  );\r\nreturn result;\r\n};\r\n```"},"comment":{"url":"https://api.github.com/repos/auth0/meteor-auth0/issues/comments/234070931","html_url":"https://github.com/auth0/meteor-auth0/issues/29#issuecomment-234070931","issue_url":"https://api.github.com/repos/auth0/meteor-auth0/issues/29","id":234070931,"user":{"login":"jlevycpa","id":16170626,"avatar_url":"https://avatars.githubusercontent.com/u/16170626?v=3","gravatar_id":"","url":"https://api.github.com/users/jlevycpa","html_url":"https://github.com/jlevycpa","followers_url":"https://api.github.com/users/jlevycpa/followers","following_url":"https://api.github.com/users/jlevycpa/following{/other_user}","gists_url":"https://api.github.com/users/jlevycpa/gists{/gist_id}","starred_url":"https://api.github.com/users/jlevycpa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlevycpa/subscriptions","organizations_url":"https://api.github.com/users/jlevycpa/orgs","repos_url":"https://api.github.com/users/jlevycpa/repos","events_url":"https://api.github.com/users/jlevycpa/events{/privacy}","received_events_url":"https://api.github.com/users/jlevycpa/received_events","type":"User","site_admin":false},"created_at":"2016-07-20T20:25:14Z","updated_at":"2016-07-20T20:25:14Z","body":"I submitted a vulnerability report to Auth0 through their responsible disclosure program about this on April 20 (ticket 8438). There has been a little bit of back and forth about it but it seems to have been largely ignored. Based on my experience with this I can't imagine ever trusting Auth0 with authentication for my application."}}
{"actor":{"display_login":"jlevycpa"}}