search

xamarin / Xamarin.Auth

Xamarin.Auth
Apache License 2.0
541 stars 351 forks source link

OAuth2Authenticator does not check CSRF foregeries in Implicit Grant #285

Closed mipnw closed 6 years ago

mipnw commented 6 years ago

Xamarin.Auth Issue

OAuth2Authenticator checks for forgeries only sometimes. In Implicit Grant the state is returned via a fragment, not a query, and it doesn't get checked against the expected state, leaving the app vulnerable to CSRF.

I have a fix. I'll submit a PullRequest shortly.

Version

-nuget version = 1.6.0.1

newky2k commented 6 years ago

PR Submitted