Tag Info

New answers tagged


If the user is authenticated and an attacker manages to use some kind of exploit to inject javascript (or flash) into the page, then yes, the attacker will be able to steal the secret token. They simply make a request using AJAX to the /auth endpoint and read the redirect URL that comes back. This was made possible recently by the addition of the responseURL ...

Top 50 recent answers are included