3 ms·
But in the POC link, they have state=1 as a parameter for the authorization server, there is another state parameter encoded into the value for the redirect_uri
by matja 3y ago
But in the POC link, they have state=1 as a parameter for the authorization server, there is another state parameter encoded into the value for the redirect_uri, which makes me wonder why that even matches the registered redirect_uri.
- 0xcrypto 3y agoYou are right that redirect_uri must match the exact registered redirect_uri. But some providers allow query parameters. For Microsoft, it was possible in 2020 when I reported the vulnerability. In 2022, they restricted query parameter support to only applications that is built for Work and School accounts and in August 2022, they added a section for this in the documentation. See: - Commit: https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548d0a6d230f57bb132e1cf3e1d51ba977 https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548... - Current Documentation: https://learn.microsoft.com/en-us/azure/active-directory/develop/reply-url#query-parameter-support-in-redirect-uris https://learn.microsoft.com/en-us/azure/active-directory/dev...