New cheat sheet proposal: OAuth about cheatsheetseries

[righettod]

Hi,
Thanks you very much for the proposal.
Sound interesting, i'm ok with the proposal but only if the cheat sheet is pragmatic and provide directly useful information to dev team but it's seems to be your objective according to your post.
@ThunderSon @mackowski Your opinion?

[ThunderSon]

Hello @garethventon :) This issue has been flagged with Help Wanted. If you feel like doing it, kindly let us know in order to remove the label.

[mackowski]

@MarcinHoppe No worries I will ping you if we will make some progress here for review :)
@bschach @philippederyck do you want to contribute? We have the skeleton just need to fill the gaps :)

[bschach]

Very sorry, will also hardly find time for this in the next weeks :-(
But in the OAuth Security Workshop 2 weeks ago, @andifalk brought up the idea of a cheatsheet again. Maybe he and some others from the community would like to contribute.

[mackowski]

Good idea!

[righettod]

Proposal highly accepted 😃
Please, use the cheat sheet template to create the CS.
Ping us when you start working on the cheat sheet in order that we update the ticket status in the project plan.
Thanks in advance 😃

[garethventon]

Happy to contribute and share some insights I'll likely need some assistance though.

[ThunderSon]

We'd be more than happy to assist, or even contact people that can give better assistance. I'll assign it to you. You can hit us up on Slack as you already know us :)

[mackowski]

Hey @garethventon what is the status on the issue? Do you need any help from us?

[garethventon]

Afternoon, The quick answer is yes, we've a few tested patterns for OAuth implementations recently but the objective of turning this into a cheat sheet has lost some of it's momentum unfortunately.

…

On Wed, 31 Jul 2019 at 07:55, mackowski ***@***.***> wrote: Hey @garethventon <https://github.com/garethventon> what is the status on the issue? Do you need any help from us? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#67?email_source=notifications&email_token=ALJ7Y5RMRSFDWXJ23OOHQEDQCEZORA5CNFSM4HES4FPKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3GJCDI#issuecomment-516722957>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ALJ7Y5TAEHKFOKOR7MI4PK3QCEZORANCNFSM4HES4FPA> .

-- Gareth Venton ISBP Information Security Business Partner / Security Consultant (Digital) *Information Security* *Working together to power a stronger Co-op* Mobile - 07786171163 ******************************************************************************** This email has been sent from Co-operative Group Limited, a registered society incorporated in England and Wales (525R) or from one of its group undertakings (jointly "the Co-op") as follows, each of which is registered in England and Wales and has its registered office at 1 Angel Square, Manchester, M60 0AG (except The Manx Co-operative Society Limited and Nisa Retail Limited whose registered addresses are listed below): Co-operative Group Food Limited (26715R) Co-operative Foodstores Limited (32443R) Funeral Services Limited (30808R) CFS Management Services Limited (05564787) Co-operative Legal Services Limited (05671209) Co-operatives E-Store Limited (29166R) The Co-operative Care Limited (31438R) Co-operative Community Investment Foundation (04117665) The Manx Co-operative Society Ltd (IM25) (which is registered in the Isle of Man and whose registered office is at 4 Myrtle Street, Douglas, IM1 1ED) Nisa Retail Limited (00980790) whose registered address is the Member Support Centre Waldo Way, Normanby Enterprise Park, Scunthorpe, North Lincolnshire, United Kingdom, DN15 9GE To the extent that this email relates to the supply of groceries to Co-operative Group Limited or any of its group undertakings, it is sent subject to Co-operative Group Limited’s Standard Terms of Supply of Groceries. For the purchase of non-grocery related goods and services, the Co-operative Group non-grocery standard purchasing terms apply to all orders placed, save where a contract is negotiated and agreed. For full details please go to coop.co.uk/purchasingterms Confidentiality Notice This email is private and confidential and may be legally privileged. If you have received this email in error, please send it back to us, and immediately and permanently delete it. Do not use, copy or disclose the information contained in this email or in any attachment. The Co-op uses security software which routinely monitors and sometimes blocks emails. Further monitoring may be conducted for general business or security purposes, but only where lawfully permitted. The Co-op cannot accept liability for any damage which you may sustain as a result of software viruses or interception or interruption of email, so please carry out you own virus checks before opening an attachment. A list of the directors for each of the societies and companies is available at the registered office. The Co-operative Legal Services and Co-op Legal Services are trading names for Co-operative Legal Services Limited which is authorised and regulated by the Solicitors Regulation Authority under SRA number 567391. The Co-op Foundation is a working name of the Co-operative Community Investment Foundation which is an independent charity regulated by the Charity Commission for England and Wales under registered number 1093028 and by the Office of the Scottish Charity Regulator (OSCR) under registered number SCO48102. ******************************************************************************** Disclaimer 00001

[ThunderSon]

@garethventon Can you share with me the findings? You can find me on Slack 😄

[righettod]

Hello,

As the issue is assigned since many time and we do not have received any PR for this then we send it back to the backlog and we set it as HELP_WANTED.

Thank you very much in advance for your understanding 😃

[jmanico]

The latest OAuth security best practice doc is here https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15 if all we do is convert this to a cheatsheet we wim, I can even ask Fett or Lidderstat if they will review it. Anyone?

[mackowski]

There is draft for this CS: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets_draft/OAuth_Cheat_Sheet.md.
@MarcinHoppe do you still want to work on this?

[MarcinHoppe]

I'd love to but I am afraid I can't commit to it now. I just don't have the time.

[philippederyck]

Sounds great, but I don't have time right now to work on this.

[mackowski]

Very old new cheat sheet proposal; I am closing this.