News for hackers. Stuff that matters.

A comment on Microsoft Account's OAuth tokens leaking via open redirect in Harvest. Parent comment

Re:Microsoft Account's OAuth tokens leaking via open redirec... by madeofpalk on Sunday October 22, 2023 @04:53PM (#37978990)
At the least you're supposed to validate the at the returning "state" parameter is the same value as what you sent (using cookies or local storage).

Ideally you would 'consume' the token before redirecting, and not send it to the second redirecting url.

[ Parent | on HN ]

There are no comments on this comment yet.