4 ms·

I'm having trouble understanding the paper. Can someone break down which part people are getting wrong? Is it that the `state` challenge isn't correctly being m

I'm having trouble understanding the paper. Can someone break down which part people are getting wrong? Is it that the `state` challenge isn't correctly being matched server-side? Separately - is there an app someone can run to "hack themselves" and see if their OAuth2 implementation is safe?

throwaway2016a 10y ago
Nearest I can tell... the client app is trusting the user ID sent back to it so you can login with your own (the hacker) user name and password and then replace the userid in the returned value with your victims and many mobile apps will let you continue assuming you are the victim.