PWPP

Practice session

An OAuth 2.0 authorization code flow uses the `redirect_uri` parameter. An attacker registers `https://attacker.com` and sends a crafted authorization request with `redirect_uri=https://attacker.com`. The authorization server doesn't strictly validate the redirect URI and issues a code to the attacker's server. What attack is this?

Loading your practice session…