For all the complexity of OAuth, an OAuth token is essentially a free pass for $stuff.
Perhaps we could start validating that a token not only is valid, but also is digitally, freshly signed with a known certificate?
I'd say there's a huge difference between:
* I stole a token
* I stole the token AND am able to keep signing said token with my victim's public certificate
A token can be stolen from many places and is comparatively easy to obtain, while full intrusion into an org's infrastructure is less likely, and even if it happens, eventually will be remediated (and the related certificate will be revoked).
I like this idea makes tons of sense… not only is the token valid but it’s from a trusted source… it is not going to prevent future attacks but it will add one more lock for an attacker to break before gaining access that is a good thing…
I think HTTP request signing will be a non-starter for an interoperable standard like oauth because of the difficulty of canonicalization without an authoritative library. AWS can pull that off because they have an SDK that will canonicalize requests for you, and it's tested in lockstep with the server accepting it. Historically, XML (and JSON to a lesser extent) have been security minefields for this exact reason.
AFAIK according the draft HTTP request signing rfc [1] defines explicit instructions for normalising, serialising and signing HTTP headers (not body). However, you can use an HTTP Digest header for example, that is a hash of the plaintext body to authenticate the body
Perhaps we could start validating that a token not only is valid, but also is digitally, freshly signed with a known certificate?
I'd say there's a huge difference between:
* I stole a token
* I stole the token AND am able to keep signing said token with my victim's public certificate
A token can be stolen from many places and is comparatively easy to obtain, while full intrusion into an org's infrastructure is less likely, and even if it happens, eventually will be remediated (and the related certificate will be revoked).
Edit: looks like https://tools.ietf.org/id/draft-ietf-oauth-mtls-09.html would fit the bill.