Mitigating OWASP Top 10 Risks: Finding and Patching access token leakages via unvalidated application redirections in Shopify
Understanding the Vulnerability: Unvalidated Redirects and Access Token Leakage Shopify applications, particularly those leveraging OAuth for authentication, are susceptible to a critical OWASP Top 10 vulnerability: “Server-Side Request Forgery” (SSRF) and its close cousin, “Unvalidated Redirects and Forwards” (A06:2021). When an application redirects a user after authentication or an action, and the redirect URL is […]