[OAUTH-WG] WRAP session fixation?

[Brian Eaton <beaton at google.com>]

On Tue, Nov 24, 2009 at 4:35 PM, Mike Malone <mjmalone at gmail.com> wrote:
> One final note - unless I'm missing something WRAP is vulnerable to
> the same session fixation attack that OAuth 1.0 had... unless it's
> requiring callback registration, which is a really lame solution to
> that problem.

Callback registration is not required to prevent session fixation.
Check out the requirements in section 5.4.6 "Successful Access Token
Response From Authorization Server."  They are (supposed to) be
sufficient to prevent the attack.

Cheers,
Brian