Question

I’m trying to set up authentication in my app. I have the posting to the external website working (facebook and google)

[AcceptVerbs(HttpVerbs.Post | HttpVerbs.Get), ValidateInput(false)]
    public ActionResult OpenIdLogOn(string returnUrl)
    {
        var redirectUrl = "~/Companies/LogIn";
        var provider = Request.Form["provider"];
        if (Common.IsNull(provider))
            return View();            
        OpenAuth.RequestAuthentication(provider, redirectUrl);
        return View();
    }

This works by figuring out what button was clicked (Login with facebook / Google) Then requests authentication. When the authentication has finished and I get a post back, I try to retrieve the email address.

public ActionResult LogIn()
    {
        var redirectUrl = "~/Companies/LogIn/OpenIdLogOn";
        var response = Response;
        var userEmail = Request.Params[16];
        if (!String.IsNullOrEmpty(ReturnUrl))
        {                
            Response.Redirect("~/Bloggers");
        }

        ViewBag.OAuthProviders = OpenAuth.AuthenticationClients.GetAll().ToList();
        return View();
    }

The following will work if I log in with google –

var userEmail = Request.Params[16];

but facebook doesn’t send the email back. Well I cant see it in the request. There must be a better way of doing this than using Request.Params[16];
also. Help would be much appreciated.

Answer 1

Without being able to see what OpenAuth is, it’s pretty hard to say what the new code should look like. But suffice it to say that you should absolutely never scrape the email address directly from the request. All security offered by OAuth and OpenID are worthless when you do that. You need to get the email address from the security library you’re using.

For Google, that means getting it from the FetchResponse or ClaimsResponse extensions of the response.

For Facebook, that means using the access token returned from the login to fetch the email address from Facebook and verify the audience field to make sure the access token isn’t being redirected to your site as part of a user spoofing attack.