3 ms·

you register not full path+query, only domain. Every website has huge attack surface

• klapinat0r 14y ago
  Sorry if I misunderstand, but would that mean that (along with what you wrote about whitelist/static) a "replace hash values", for instance, would mitigate the attack? I currently have a OAuth (1.0a) implementation down the road (and would be very willing to hiring you when we begin). Am I understanding this correctly that a "good" practice would be to redirect the user always to e.g. a static "you've granted app X permissions", or other dummy page (within our domains control) which the user will simply close, or oob? Not asking you to dish out your expertise, just a quick question :) And thanks for the nice articles, you're doing a lot of good.
  • homakov 14y ago
    1.a does not implement Implicit flow (sending token #token=..) sending #_=_ is only protection of facebook open redirect, it's impossible to do same on every possible open redirector on the client's website. by static I mean exact value of path+query