Read the original article: API Security Weekly: Issue #86
Vulnerability: Sign In With Apple
Sign in with Apple is an OAuth-like social logon system from Apple. It is widely used, and in fact, Apple mandate the inclusion of Sign in with Apple in apps with other social-based login systems. Now, Bhavuk Jain has found a way to impersonate himself as any user in it.
Just like other similar systems, Sign in with Apple authenticates a user and produces a signed JWT token. The user’s client then uses that token to access the site or app that the user wanted to sign in to. The app finds the information about the user from the token (JWT tokens are encoded signed JSON structures), and verifies that the token has been signed by Apple and thus can be trusted.
Read the original article: API Security Weekly: Issue #86