> Your site did not create the redirect URI that is being passed to Google / Twitter in your example.
Sorry, I don't understand this sentence.
The redirect URI is not normally passed to Google / FB / Instagram dynamically, but normally registered with Google / FB / Instagram once, when you set up an app with them (and get a secret key etc).
If someone else registered their own app with their own redirector, they wouldn't have my secret key.
Edit: removed Twitter, they use oAuth 1 which is strange / different / weird.
Re:OAuth 2.0 and OpenID Redirect Vulnerability
by icebraining on Friday May 02, 2014 @11:03AM
(#7686081)
No, you do pass the URI dynamically, it's a required part of the Access Token Request: http://tools.ietf.org/html/draft-ietf-oauth-v2-16#section-4....
It's just that with a decent implementation, you should also be required to register it beforehand with the provider.
Re:OAuth 2.0 and OpenID Redirect Vulnerability
by vertex-four on Friday May 02, 2014 @11:17AM
(#7686181)
Not just a decent implementation; an implementation which meets the spec. This is not a problem with OAuth2, which explicitly requires registration of URIs where the implicit grant type is used, and covers other cases well in the Security Considerations section.
The URL is generated by a malicious party. The URL constructed (1) sends the user to Google / Twitter for authentication, (2) includes a return URL of your open redirector, and (3) has your open redirect send you on to an evil site.