Web Security · Senior · Question 44 of 75

How can an authorization code or token leak through the `Referer` header?

1Because the OAuth provider sets the Referer header to the token
✓Correct answer: The callback page contains the code in its URL and loads third-party resources or links out before cleaning the URL
3Because the Referer header contains the user's cookies

Explanation

Redeem the code immediately, replace the URL with history.replaceState, and set a strict Referrer-Policy on callback pages.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.