# OAuth code leak via fragment and referrer

OAuth codes or id_tokens landing in URL fragments, Referer, CSP reports, or error-path redirects that cross origins

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; 2 confirmed bounties: $400 and $4,000; latest 2021-11-13. Updated 2026-11-01._

## How it works
OAuth assumes the authorization code or id_token reaches only the registered redirect_uri. That assumption breaks when the value is placed somewhere that survives a redirect or is readable by another origin: the URL fragment, a Referer header, a CSP violation report, or a redirect on an error path. A fragment is never sent to the server but is preserved by client-side redirects, so any open redirect on the redirect_uri's origin carries the secret to an attacker. A browser API that reports the final cross-origin URL leaks it the same way. An authorization endpoint that redirects to the supplied redirect_uri even on an error (invalid scope, bad client) turns the trust boundary into an open redirect [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)[E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)[E3](https://bugbountylibrary.com/r/h1%3A3930.md).

## Where it shows up
- Multi-valued `response_type` such as `code id_token` (hybrid flow), where the code may move from query to fragment [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Redirect handlers on the client origin that preserve the fragment across further redirects [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Open redirects on the redirect_uri's own domain, including app-only endpoints [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- CSP `SecurityPolicyViolationEvent` attributes (`documentURI`, `blockedURI`) on cross-origin redirects [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- CORS/fetch error objects exposing the destination URL [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- OAuth dialogs that redirect to `redirect_uri` on invalid scope or bad client instead of erroring in place [E3](https://bugbountylibrary.com/r/h1%3A3930.md)

## How to review
State the invariant: the code/id_token must be delivered only to the exact registered redirect_uri, in the query string, and must not survive any further redirect or be observable by another origin. Check:
- Does the provider accept multi-valued `response_type`, and where does it put the code for each? [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Does the client redirect handler re-redirect while keeping the fragment? [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Is there any open redirect (including app-only or legacy endpoints) on the redirect_uri origin? [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Do browser events/reports (CSP, CORS errors) expose the final cross-origin URL, and does that match the spec? [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- Does the auth endpoint validate scope/client before redirecting, or redirect on error? [E3](https://bugbountylibrary.com/r/h1%3A3930.md)

## How finders spotted it
- Read the provider's OpenID Connect docs, saw `response_type` could hold multiple values, and tested `code id_token` to observe the code move to the fragment [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Downloaded the mobile app and probed an app-only endpoint with a bad token to find an open redirect [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Compared Safari's CSP `documentURI` against the W3C spec and other browsers on cross-origin redirects [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- Sent an invalid scope to the OAuth dialog and noticed it still auto-redirected to the supplied redirect_uri [E3](https://bugbountylibrary.com/r/h1%3A3930.md)

## Variants seen
- Hybrid flow placing code in fragment, exfiltrated via open redirect [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)
- Browser CSP/CORS leak of final redirect URI containing code/token [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- Error-path redirect acting as open redirect, chained with third-party OAuth [E3](https://bugbountylibrary.com/r/h1%3A3930.md)

## Why fixes fail
UA-sniffing fixes for the WebKit leak were bypassed using `<a ping>` on iOS WebKit [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md).

## Impact and severity
Full account takeover: Flickr [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md), and at scale across Facebook, Google, Instagram, WhatsApp and "Login with" integrations [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md); token theft chained through Facebook/Disqus [E3](https://bugbountylibrary.com/r/h1%3A3930.md). Impact rose with reach (many relying providers) and chaining with an open redirect or browser leak [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md)[E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)[E3](https://bugbountylibrary.com/r/h1%3A3930.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-12-yahoo-bug-bounty-exploiting-oauth-misconfiguration-to-takeover-flickr-accounts.md
- E2: https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md
- E3: https://bugbountylibrary.com/r/h1%3A3930.md