security - Advantages of Hash Verification of Parameters and Content over TLS -

security - Advantages of Hash Verification of Parameters and Content over TLS -

when researching approaches securing web services, found application hashes portions of url in add-on utilizing tls. found specification proposes verify body of request producing hash , verifying content server side (specification follows):

final: oauth request body hash

in specification, mentions:

nonce checking , utilize of https can mitigate risk, may not available in environments. when nonce checking , https used, signing request body provides additional layer of defense.

looking @ oauth 2.0 specification, seems though have deemed these steps unnecessary when application configured/coded, instead relying on tls provide security features, of which, believe, includes tamper proofing. while there has been criticism specification people former lead author, has been said (by same person) when implemented, secure.

is there real benefit these hashing procedures? there known attacks compromise web service utilizes nonce , tls verify validity?

as far can tell quick read of documentation (i don't know much oauth), confusing purpose of hash. inclusion of hash meant extend signature covering other parts of request body:

the oauth core specification provides body integrity checking application/x-www-form-urlencoded request bodies. other types of request bodies left unsigned.

note including hash in url not provide additional security. instead, include in part signed:

set oauth_body_hash parameter obtained value.

sign request per [oauth core 1.0] section 9. oauth_body_hash parameter must included in signature base of operations string other request parameters.

thus, statement "even when nonce checking , https used, signing request body provides additional layer of defense." refers practice of signing url parameters (among other stuff) via rsa (or "signing" via hmac) , authenticating body via included hash. if url parameters not signed (the "plaintext" method used), not gain additional security including hash of body.

security ssl hash