Taking Over Booking.com by abusing social login

Really enjoyed this. In general, horrible idea to accept anything other than a fixed list of redirect_uris in production.

OAuth 2.1 actually codifies that as a best practice: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-07.htm...

See a short demo video here: https://youtu.be/IK_AV1UFS-0

This stuff is good, thanks for sharing!