OAuth redirect_uri Lab: Steal a Login Code With a Loose Check

AuthHub decides where to send your OAuth login code by checking that the redirect_uri merely contains the string trustedclient.com. A substring check feels close enough — but 'contains' is not 'is', and that gap is enough to ship the login code to an attacker. Lab at a glance: Intermediate · 90 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="oauth-redirect-1"] 📋…

Read full article →