3 ms·

The client can intercept whatever URL the embedded webview is redirected to. The callback URL provides no security against this.

• Kudos 14y ago
  That's not a drive-by hijack, all bets are off when it comes to apps. For all you know the app is presenting a fake login dialog. It would be a drive-by hijack on the web because there's a good chance you're already authenticated with Twitter and the callback cycle will automatically grant credentials on your behalf to the requester with no prompt.
  • zwily 14y ago
    Right - we were discussion OAuth in the context of client apps.
    • Kudos 14y ago
      I'm pretty sure I was setting the context, and that context was the web.
      • zwily 14y ago
        Fair enough. I was referring to the larger discussion.