To quote the OAuth spec:
If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the fragment component of the redirection URI using the "application/x-www-form-urlencoded" format, per Appendix B:
Let's say I'm trying to phish an Example.com account. What prevents me from doing an attack like this:
- Register a similar-looking domain. We'll use
https://exámple.comfor this example.
- Set up
exámple.com/loginto look like the real Example.com's login so I can steal credentials.
- Register an OAuth app with a redirect URI of
- Construct a deliberately-invalid OAuth authorization request and get a user to visit it. It might look like this:
- When the user visits it, the real
example.comwill see that my request is invalid (
example.comwill redirect to
https://exámple.com/login?error=invalid_request(or similar), which I've set up to phish Example.com users.
This isn't the biggest vulnerability in the world, but if I can trick you into clicking on a link, I can take over your account. I expect a lot of users would click any URL where the domain was
google.com, for example.
What steps can an OAuth provider take against such an attack? In the example above, what could Example.com do?