News for hackers. Stuff that matters.

A comment on Microsoft Account's OAuth tokens leaking via open redirect in Harvest. Parent comment

Re:Microsoft Account's OAuth tokens leaking via open redirec... by johncolanduoni on Sunday October 22, 2023 @03:34PM (#37978361)
Don't attach the sensitive URL parameters to the second redirect. The first redirect logs you in via cookie, and then if the second redirect is on the right origin it will have access to your cart.
[ Parent | on HN ]

There are no comments on this comment yet.