My application uses Google's OAuth for authenticating users. For development/debugging purposes I want to be able to run it locally (on my dev. machine). To have the OAuth login functionality work in this mode I can configure the OAuth such that http://localhost:<some_port> is whitelisted as an authorized origin (see screenshot, below).

My questions:

  • What are the security implications of this?
  • Are there any other ways to achieve that? (I believe I can run a local forward proxy but I am not sure how to get it to work with HTTPS)

localhost:3000 whitelisted


Generally it means that one can trick Google (or another Authorization Server) to send a valid authentication token to localhost, from a client point of view.
Assuming that for that client "localhost" will always resolve to a 127/8 address, and those is handled on a local interface; if another process is listening on that port, it might be able to steal that token.

If, somehow, with a particular configuration your machine would try to append your domain (e.g .domain.com) to "localhost" query; someone could poison that, and you'd send your auth token to an arbitrary host.

  • Thanks! So how would your answer change if instead of "localhost:3000" I would use "" (i.e what are the security risks in whitelisting as an allowed origin)? – Itay Maman Sep 18 '18 at 13:49
  • Same as the "arbitrary process potentially running on that machine", but it solves the DNS issues. – ndrix Sep 18 '18 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.