evil.example.comCSRF Demo

Attacker's Page

This page simulates a CSRF attack against the OAuth flow.

Attack explanation

  1. Attacker crafts an authorization URL targeting their own callback (/steal)
  2. Attacker tricks the victim (already logged in at ClowderID as alice) into clicking it
  3. Provider issues a code for alice and redirects to /steal
  4. Attacker exchanges alice's code at /oauth/callback → logged in as alice

If state were used, the victim's browser would reject the callback because the state wouldn't match.

Step 1: Make sure you're logged in at the provider: Login as alice

Step 2: Click the malicious link (simulates victim clicking attacker's link):

View captured codes