Brandon Trebitowski
https://brandontreb.com
•
Mar 2
Could using PKCE fix this issue?
WeChat ID
aaronpk_tv
-
Yep! This is exactly the kind of thing PKCE prevents! With PKCE, even if the open redirect were in place, the attacker wouldn't have been able to do anything with the stolen authorization code.
Although now I'm thinking this through and if the open redirects are really open enough, you could probably still pull something off even while using PKCE.
Posted in
/replies
using
monocle.p3k.io
True, but it would be tricky.
Wouldn’t the attacker have find a way to extract the
code_verifierfrom local storage and pass it along with the hijacked redirect?They would have to somehow have the ability to write custom js code on the path they are redirecting to. I guess this is possible on sites that don’t sanitize user inputs.