Top 10 winner
OAuth Non-Happy Path to ATO
Switching response_type from code to id_token derails the callback into an error branch that redirects to the Referer with no parameters, while the tokens sit in the fragment, which server-side 3xx redirects preserve. window.open plus a 3xx chain keeps the attacker page as the Referer, prompt=none skips Google's account picker, and Google accepts response_type=code,id_token, so the fragment handed to the attacker carries the authorization code.
Record
- Researcher
- Omid Rezaei
- Published by
- Voorivex Team
- Date
- Topic
- Identity
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Omid Rezaei, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .