OAuth 2.0 and OpenID Redirect Vulnerability

Re:OAuth 2.0 and OpenID Redirect Vulnerability by EGreg on Friday May 02, 2014 @11:36AM (#7686312)

I read all the above and I still don't see how the attacker would "gain access" to the user's info on the platform. How do they get the bearer token?

?next=URL is usually implemented to redirect to the URL, and won't propagate the bearer token off the app to the attacker's site. What Am I missing?

[ Parent | on HN ]

Re:OAuth 2.0 and OpenID Redirect Vulnerability by kordless on Friday May 02, 2014 @08:20PM (#7688977)

Given you implemented it correctly, I would agree with you. A bad implementation would allow for preservation of the URL's parameters ala urllib.urlencode(self.request.params) or similar, which would contain the token.

[ Parent | on HN ]