OAuth redirect_uri / flow tricks
Allowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin.
Tags: oauth, oidc, ato
Techniques
Prefix allowlist
startsWith(https://target.com) loses to target.com.evil and target.com%40evil depending on the parser.
https://target.com.evil.examplehttps://target.com%40evil.examplehttps://target.com.evil.example/callback
Path traversal on ACS
Registered /oauth/callback plus /../ on the same origin, or an open redirect sitting on that origin.
https://target.com/oauth/callback/../../redirect?next=https://evil.example
response_type downgrade
A code client that still accepts token or id_token in the fragment. Token never hits your server logs; it hits the fragment on a bounce.
response_type=tokenresponse_type=id_tokenresponse_type=id_token token
state CSRF
Missing or predictable state lets you bind the victim's authorization to your session (login CSRF on SSO).
state=state=aaaa(omit state)