Skip to content

Latest commit

 

History

History
12 lines (8 loc) · 847 Bytes

README.md

File metadata and controls

12 lines (8 loc) · 847 Bytes
Raw

OAuth Redirect URI Test

App Icon

A relatively common OAuth and OpenID Connect implementation flaw is to allow arbitrary schemes for the redirect_uri parameter within the Auth. Request. This enables CSRF-style credential disclosure attacks using custom URL schemes for native applications.

This simple demo application registers the URL scheme com.test.test:// and prompts received data on activation via Intent.

Example:

  1. Install Application (either from source or via the Play Store: https://play.google.com/store/apps/details?id=com.lauritz.oauthredirecturitest).
  2. Click the following link: com.test.test://example.com/callback?code=test#access_token=test2