News for hackers. Stuff that matters.

A comment on Microsoft Account's OAuth tokens leaking via open redirect in Harvest. Parent comment

Re:Microsoft Account's OAuth tokens leaking via open redirec... by matja on Sunday October 22, 2023 @05:25PM (#37979225)
But in the POC link, they have state=1 as a parameter for the authorization server, there is another state parameter encoded into the value for the redirect_uri, which makes me wonder why that even matches the registered redirect_uri.
[ Parent | on HN ]
Re:Microsoft Account's OAuth tokens leaking via open redirec... by 0xcrypto on Monday October 23, 2023 @03:53AM (#37982695)
You are right that redirect_uri must match the exact registered redirect_uri.

But some providers allow query parameters. For Microsoft, it was possible in 2020 when I reported the vulnerability. In 2022, they restricted query parameter support to only applications that is built for Work and School accounts and in August 2022, they added a section for this in the documentation.

See: - Commit: https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548... - Current Documentation: https://learn.microsoft.com/en-us/azure/active-directory/dev...

[ Parent | on HN ]