ClowderApp
Sign in with your ClowderID account using OAuth.
How this OAuth flow works
- Click Login with ClowderID — app redirects you to the provider
- You approve access on the provider
- Provider redirects back with an authorization code
- App exchanges code for access → you're logged in
Notice: the redirect URL contains no state parameter.
Demo accounts on provider: Visit
/oauth/provider/login to log in as alice.
Attacker simulation: /attacker — demonstrates the CSRF attack.