Leaky Images in OAuth

Justin Richer
Jul 14, 2017 · 5 min read

The Setup

A typical OAuth authorization screen

The Problem

Browser making a request for the image embedded in the page
Referer header, second from bottom

A Solution

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade