Prevention Mechanisms for Stolen Access Token Injection Attack in Financial-grade API
De-Cian Li, Ching-Huang Lin · 2023
In this paper, we will discuss the challenges of Financial-grade API, focusing on prevention mechanisms for "Cuckoo’s Token Attack" and delve into the current security authentication mechanisms of OAuth 2.0, Financial-grade API 2.0 and OpenID Connect. Finally, we found that the OpenID Connect method can mitigate the attack by using a one-time token and issuer identifier, but a one-time authentication method without the OpenID Connect requirement is also needed.