Collected research
Stealing oAuth Token via Referrer Policy Override
Turns a limited image injection into OAuth-code leakage by controlling the image response. A Link preload header specifies unsafe-url referrer policy, causing the documented Chrome behavior to disclose the embedding page’s query URL to the attacker; an application testbed demonstrates the required redirect and subresource conditions.
Record
- Researcher
- Omid Rezaei
- Published by
- Voorivex
- Date
- Topic
- Identity
In the archive
Related sources
- OAuth Token Leak via Referer Policy Override Demo Code
- Chromium Link-header behavior discussion
- Referrer override practice application
Tags
This page is the archive's own catalogue record. The research is the work of Omid Rezaei, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .