AWS athena medium security documentation change
Summary
Updated OAuth 2.0 callback endpoint from http://localhost:7890/athena to http://127.0.0.1:7890/oauth/callback.
Security assessment
Change mitigates potential DNS rebinding attacks by using 127.0.0.1 instead of localhost. Explicit security improvement per OAuth security best practices.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md b/athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md index db052b223..3fb19a3cc 100644 --- a//athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md +++ b//athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md @@ -84 +84 @@ sso_oidc_timeout | Optional | `120` | `sso_oidc_timeout=60;` -The local port number to use for the OAuth 2.0 callback server. This is used as the redirect URI and you may need to allowlist this port on your network. The default generated redirect URI is: `http://localhost:7890/athena`. This parameter was added in v2.1.0.0 as part of the migration from Device Code to Authorization Code with PKCE. +The local port number to use for the OAuth 2.0 callback server. This is used as the redirect URI and you may need to allowlist this port on your network. The default generated redirect URI is: `http://127.0.0.1:7890/oauth/callback`. This parameter was added in v2.1.0.0 as part of the migration from Device Code to Authorization Code with PKCE.