Web Security · Senior · Question 48 of 75

An OAuth provider allows `redirect_uri=https://app.com/callback/../open-redirect?to=evil`. What combination creates a token leak?

✓Correct answer: Loose redirect URI matching plus an open redirect on the client domain lets the code flow to the attacker
2Using HTTPS on the callback
3Having more than one scope

Explanation

Each bug alone may look minor. Exact matching on the provider and no open redirects on the client break the chain.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.