Web Security · Senior · Question 43 of 75
What is an OAuth mix-up attack?
- 1Users mixing up their passwords for different sites
- 2Scopes being returned in the wrong order
- ✓Correct answer: With several identity providers, the client is tricked into sending a code from one provider to an attacker-controlled one
Explanation
Defenses include checking the iss parameter in the authorization response and using distinct redirect URIs per provider.