security protocol_error ai_generated true

OAuth2 implicit grant flow leaks access token in URL fragment

ID: security/oauth2-implicit-grant-token-in-url

Also available as: JSON · Markdown · 中文
88%Fix Rate
85%Confidence
1Evidence
2023-11-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OAuth 2.0 RFC 6749 active — — —
OAuth 2.0 Security BCP (RFC 9700) active — — —

Root Cause

The OAuth2 implicit grant flow returns the access token in the URL fragment, which is exposed in browser history, referrer headers, and server logs.

generic

中文

OAuth2 隐式授权流程在 URL 片段中返回访问令牌，该片段会暴露在浏览器历史记录、引用标头和服务器日志中。

Official Documentation

https://oauth.net/2/grant-types/implicit/

Workarounds

  1. 95% success Migrate from the implicit flow to the authorization code flow with PKCE. Example: `response_type=code&code_challenge=...&code_challenge_method=S256` instead of `response_type=token`. 
    Migrate from the implicit flow to the authorization code flow with PKCE. Example: `response_type=code&code_challenge=...&code_challenge_method=S256` instead of `response_type=token`.
  2. 60% success If migration is not possible, add `Referrer-Policy: no-referrer` headers and discourage browser history retention via `Cache-Control: no-store` on the page. 
    If migration is not possible, add `Referrer-Policy: no-referrer` headers and discourage browser history retention via `Cache-Control: no-store` on the page.
  3. 70% success Use a custom scheme for mobile apps to reduce exposure to browser history and referrer leakage. 
    Use a custom scheme for mobile apps to reduce exposure to browser history and referrer leakage.

中文步骤

  1. 从隐式流程迁移到带 PKCE 的授权码流程。示例：使用 `response_type=code&code_challenge=...&code_challenge_method=S256` 代替 `response_type=token`。
  2. 如果无法迁移，添加 `Referrer-Policy: no-referrer` 标头，并通过页面上的 `Cache-Control: no-store` 阻止浏览器历史记录保留。
  3. 对移动应用使用自定义方案，以减少浏览器历史记录和引用标头泄露的风险。

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Removing the token from the URL fragment entirely breaks the flow because the client expects it there.

  2. 50% fail

    Using HTTPS alone doesn't prevent token leakage via browser history or referrer headers.

  3. 30% fail

    Shortening token expiry doesn't solve the underlying exposure; tokens are still captured in logs.