# OAuth code and token redirect leaks

Does the code or token reach only the exact redirect_uri, in the handled response mode, unreadable by other origins?

_Area: Web authentication and account takeover. Seen in 2 disclosed reports; latest 2022-08-02. Updated 2026-10-24._

## How it works
OAuth assumes the authorization code or token reaches only the client's exact registered redirect_uri, only through the response mode the client handles, and is observable by no other origin. That breaks when the IdP app still permits alternate response_type/response_mode combinations, when the landing page leaks its URL, or when browser APIs expose the final redirect target. The code is a bearer credential: whoever reads it can exchange it for the victim's session. The failure is in where the code lands and who can observe it, not in the token exchange.

## Where it shows up
- IdP app permitting response_type=code+id_token with response_mode=fragment when the client only handles web_message [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)
- redirect_uri accepting any path on the domain rather than an exact match [E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)
- Code or token landing in the URL fragment, query, or referer readable by third-party content on the page [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)[E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)
- Browser events (CSP violation, CORS errors) exposing the final cross-origin redirect URL [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)
- User-controlled fields that load external resources (analytics, custom JS, image URLs) on the redirect landing page [E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)

## How to review
Check the invariant: a code or token is delivered only to the exact registered redirect_uri, only via the response mode the client handles, and is never observable by any other origin. Concretely: does the IdP app restrict response_type and response_mode to the one the client uses, or does fragment mode remain enabled [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)? Is redirect_uri an exact match, not a prefix or any-path [E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)? Can any script, iframe, or referer on the landing page read the fragment or URL [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)[E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)? Do browser events expose the redirect target [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)?

## Variants seen
- Alternate response_type/response_mode leaking code via fragment and window.name through a third-party GTM jail iframe [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)
- Referer leakage of code from a landing page whose unvalidated analytics/image field loads attacker resources; loose redirect_uri matching widened where the code landed [E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md)
- Browser API (CSP violation event, CORS error) leaking the final redirect URI cross-origin [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md)

## Why fixes fail
Restricting the client to web_message did not stop the IdP app from still allowing fragment mode [E1](https://bugbountylibrary.com/r/h1%3A1567186.md). UA-sniffing fixes for the WebKit browser leak could reportedly be bypassed [E2](https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md).

## Impact and severity
Account takeover where a code is actually leaked: code theft yields the victim's session [E1](https://bugbountylibrary.com/r/h1%3A1567186.md)[E3](https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md). Severity is high because the code is a bearer credential; it worsens when the landing page hosts third-party script or redirect_uri is loosely matched, widening who can read the code. E1 needed the GTM jail iframe/window.name chain, not fragment mode alone.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1567186.md
- E2: https://bugbountylibrary.com/r/blog%3Athreatnix-io-blog-exploiting-csp-in-webkit-to-break-authentication-authorization.md
- E3: https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens.md