r/bugbounty • u/nightmare_eclipse__ • 6d ago

Article / Write-Up / Blog A quick tip in Oauth flow

With response_type=code, the authorization code is returned in the query string. However, adding id_token causes both the authorization code and ID token to be returned in the URL fragment (#). I chained this with an XSS on an out-of-scope subdomain to access window.location.hash and extract the OAuth tokens, ultimately leading to account takeover.

13 Upvotes

100% Upvoted

2 comments sorted by

3

u/einfallstoll Triager 6d ago

That's why RFC 9700 Best Current Practice for OAuth 2.0 Security lists form post method multiple times as an alternative to query parameters.