Cross-Tenant Request Forgery Attack in Multi-Tenancy Environments - Albert Yu & Alan Bishop

Unveiling the Cross-Tenant Request Forgery Attack in Multi-Tenancy Environments

Description
To build a SaaS application platform, most platform owners rely on integrations with more popular ecosystems such as Microsoft Azure, Google Workspace, Okta, Github, Atlassian Jira, etc. The industry has moved towards open standards like OAuth for access delegation, but there are several flavors (e.g. 3LO, 2LO, SPA) of OAuth and each flavor works in different scenarios. Some API access mandates a particular flavor of OAuth.

What's adding to the …

alan application atlassian attack azure build ecosystems environments etc forgery github google google workspace industry integrations jira microsoft microsoft azure multi-tenancy oauth okta open standards platform popular request saas saas application standards workspace