2068725 - use unique paths in OAuth redirect targets for providers that don't support the issuer ID field

Status: NEW

(Thunderbird :: Account Manager, enhancement)

Description

[Justin Tracey [:jtracey]]

In bug 2044463, we added support for RFC 9207, which prevents one OAuth provider from impersonating another using the iss field. Not all our supported providers enable this though, allowing any such provider the ability to spoof any other such provider (providers that support issuer ID cannot spoof nor be spoofed). We can get most of the same benefit though by associating unique redirection targets for each provider: If we issue an authentication request to Evil Provider, and it forwards the request to Honest Provider, the Honest Provider server would send the credential to http://127.0.0.1/honest?state=..., which wouldn't match the http://127.0.0.1/evil?state=... we were expecting. This is the strategy described in RFC 9700§4.4.2.2.