Document attacks possible when WebID Document is hosted in a Solid Storage

[elf-pavlik]

Solid-OIDC relies on solid:oidcIssuer delegation in WebID Document, SAI, similarly, relies on interop:hasAuthorizationAgent. Compromising any of them can lead to gaining owner-level access to all storage owned by the agent WebID denotes.

Prior discussion

• Security considerations for integrity of solid:oidcIssuer triples solid-oidc#219

[csarven]

There is also solid/solid-spec#106

---

After re-reading what you wrote above, are we saying the same thing: solid/solid-oidc#219 (comment) ? I mean the issuer origin. It is separate from the oidcIssuer value changing.

[elf-pavlik]

Let's separate those two cases. Here, I only focus on situations where the WebID Document is compromised and the triple with solid:oidcIssuer gets changed.

[elf-pavlik]

We plan to discuss it next week on Tuesday https://www.w3.org/events/meetings/b277ff65-0aad-425e-bd1d-64758cd4547a/20240604T140000/