Being in web development for a while, you start exploring different domains than just mastering your... Tagged with webdev, javascript, security, learning.

TIL is a community-driven platform for sharing and discovering interesting facts, trivia, and insights on a wide range of topics. Through user submissions and comments, TIL offers insights into obscure facts, historical events, scientific discoveries, and cultural phenomena. Readers can learn something new every day and contribute their own knowledge to the community by sharing interesting tidbits and trivia.

This is Learning

Unvalidated redirects in authentication flows can enable XSS attacks where malicious JavaScript is injected into redirect URLs. An attacker can craft a base64-encoded state parameter containing JavaScript code that executes during login, potentially stealing JWT tokens, localStorage data, and cookies. The vulnerability occurs when redirect URLs are not sanitized before being assigned to window.location.href. Mitigation strategies include implementing domain allowlists, using temporary authorization codes instead of passing tokens in URLs, validating redirect URLs against javascript: protocol, and detecting token reuse attempts.

Exploiting Unvalidated Redirects for XSS

Overview Of XSS Vulnerability In Redirection