Security concern

[edgarogh]

I don't have any qualification in security so I may be completely wrong in my reasoning, but I'm worried your system could be vulnerable to MitM attacks. I'd rather look stupid making this report than let this cause any harm 😅

Example

Actors:

• ExampleServer is a Minecraft server and has a website where you can log in using your Minecraft account to link both, using MinecraftID
• Alice is a frequent player on ExampleServer and doesn't have an account on their website yet
• Bob is jealous of Alice
• Bob wants to log on ExampleServer's website as if he were Alice, to create forum posts that would get her banned

Here's a scenario:

• Bob creates his own Minecraft-related website and convinces Alice to log into it using MinecraftID. Alice cannot expect this to be dangerous in any way, MinecraftID is just an authentication service after all, it does not authorize any access to the Minecraft account
• When Alice tries to log into Bob's website, Bob's website sends a request to ExampleServer's website pretending to be Alice. At this stage, MinecraftID never asks for any proof of account ownership, it just blindly accepts Alice's username and tells "Alice" to join id.minecraft.id with "her" Minecraft client.
• Bob's website actually tells Alice to join id.minecraft.id, and displays an input field for Alice to enter the authentication code the server gave her (this authentication code is actually tied to ExampleServer)
• Bob now has access to Alice's authentication code and he can log into ExampleServer's website as if he were her