{"id":13563106,"url":"https://github.com/please-openit/token-leak-extension","last_synced_at":"2025-04-03T19:32:23.352Z","repository":{"id":83058298,"uuid":"240876720","full_name":"please-openit/token-leak-extension","owner":"please-openit","description":"Chrome extension to analyse oauth2 authentication process","archived":false,"fork":false,"pushed_at":"2020-02-28T14:00:22.000Z","size":133,"stargazers_count":18,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-04T15:52:18.614Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://please-open.it","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/please-openit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-02-16T11:06:47.000Z","updated_at":"2024-08-26T09:32:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"aa13575f-d390-4b85-b57c-a1bfb3d562a7","html_url":"https://github.com/please-openit/token-leak-extension","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Ftoken-leak-extension","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Ftoken-leak-extension/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Ftoken-leak-extension/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/please-openit%2Ftoken-leak-extension/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/please-openit","download_url":"https://codeload.github.com/please-openit/token-leak-extension/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247065407,"owners_count":20877769,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T13:01:15.230Z","updated_at":"2025-04-03T19:32:23.017Z","avatar_url":"https://github.com/please-openit.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"# Please-open.it token leak extension \n\n**TL;DR** This is a chrome extension that checks oauth2/openid connect authentication process on any website. Just install it, log in and check for alerts and recommendations.\n\n## How to test\n\nOur authentication app [https://auth.please-open.it](https://auth.please-open.it) we use for portals and doors.\n\n[https://www.oauth.com/playground/](https://www.oauth.com/playground/) a great tool with all flows implemented, step by step and great details.\n\n# Company\n\n[Please-open.it](https://please-open.it) is a french company, specialized in authentication.\nWe deal with oauth2 especially with [keycloak](https://www.keycloak.org).\n\nWe have an offer based on \"Keycloak as a service\", get your own realm on our infrastructure.\n\nWe also built an authorization platform. It works with all common oauth2 providers (Google, Facebook, Twitter, Microsoft, ...) and adds : \n- user filtering based on email, Google Suite organization, groups membership on Facebook or any filtering on a user property\n- Timebased authorizations\n- Calendar restrictions\n\nWorks perfectly for doors, gates or any access control device with standard an industrial hardware.\n\n## Intro\n\nSeveral monthes ago, we discover data leak on pole emploi's website [2 failles de sécurité chez pole emploi - French](https://www.mathieupassenaud.fr/faille-pole-emploi/).\nIt shows severals and global problems : \n- lack of knowledge about authentication, oauth2 or openid connect standards (use of implicit flow)\n- Webanalytics integrated without any control : [Web analytics are the worst auth enemy](https://www.mathieupassenaud.fr/webanalytics_enemy/)\n\nFor internal use, we have a small tool for authentication process analysis. This tool was based on [apache JMeter](http://jmeter.apache.org/) with proxy recording. \n\nWe rebuilt this tool directly in Chrome using an extension. This extension checks only requests from a web page and checks for known patterns we already had. Then, a small output in an HTML popup shows potential problems.\n\nIn order to make your authentication more secure, this tool is now free and opensourced.\n\n## Status of the project\n\nIt is a big draft for now, a stack of rules hardcoded in Javascript. It displays information about suspicious requests, or misuse of tokens.\n\nContributions are welcome.\n\n## Installation\n\nToday, the extension is not published on the Chrome Webstore. Google does manual review of it due to requested permissions.\n\nClone or download this repo.\n\nGo to [chrome://extensions](chrome://extensions) and turn on \"developer mode\".\nClick on \"Load Unpacked\"\nSelect the location where you cloned this repo.\n\n[https://webkul.com/blog/how-to-install-the-unpacked-extension-in-chrome/](https://webkul.com/blog/how-to-install-the-unpacked-extension-in-chrome/)\n\nThe extension is now installed, you see a yellow lock near the address bar.\n\n## How to use\n\nGo to the authentication page of your website. The extensions is always listening.\n\n![capture](https://github.com/please-openit/token-leak-extension/blob/master/images/capture.png)\n\nIt shows directly authentication steps with a message, a level an details.\n- Green it is an info of a great use\n- Gray means manual verification is required, for example a check on the http headers.\n- Yellow a misuse\n- Red a bad usage\n- Red with a big border : a fix is required ASAP.\n\nA \"details\" link reveals the context : initiator, HTTP Method and called URL.\n\n\"More ...\" link gives you some recommendations from this repo.\n\nDo not forget to clean all results between two tests.\n\nRemember, it is a draft. Some cases are not well covered. IE, when an authorization_code is exchanged for an access_token using a backend (not with a direct call to authentication server), which is the best way to do, this exchange is sometimes not detected.\nAll informations from this app needs manual verifications.\n\n## Recommendations\n\nAll recommendations are based on [Internet Engineering Task Force](https://ietf.org) and [oauth2](https://oauth.net/2/) standards. There are not obligations, and many ways to interpret.\n\nRecommendations we write for this public tool are general, check for your frameworks, languages and usages to know how to implement the best standard for high security.\n\n## Contribution\n\nAll contributions are welcome. Check wiki pages for recommendations.\n\nbackground.js file is the analysis tool. A stack of \"if\" statements with string comparisons.\nLocal storage is needed to keep an environement between requests.\n\nchrome.storage.local is the way we found to communicate results to popup html file.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplease-openit%2Ftoken-leak-extension","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplease-openit%2Ftoken-leak-extension","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplease-openit%2Ftoken-leak-extension/lists"}