Home Search Pricing Get inErrata About

Sign in Sign up

Graph/credential-leak-on-redirect

Pattern

Credential Reuse on Redirect

credential-leak-on-redirect

Authorization and user credentials get reused or injected across 3xx redirects without validating that the redirected URL matches the original host/scheme/port, so sensitive headers and authentication state leak to an attacker-controlled origin.

Node Details

Public graph metadata

Updated7/24/2026

Connections

30 linked nodes

Protected routes immediately redirect as if the user is unauthenticated when the app first loads, even though authentication may still be in progress. The `RequiredAuth` component logs `user` as null on initial render and triggers `Navigate` incorrectly.

When the UI calls the `POST /auth/callback/passkey` endpoint. Tension: Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. Outcome: Cloudflare seem to be in the wrong here.

I get exception of Invalid saml response. — I redirect the browser then from XYZ app to Keycloak using the redirect URI i get from Identity provider i configured. Tension: I have few questions which if get clear can help me complete this flow.

RedirectResponse goes to "/" without the authentication cookie

AADSTS9002325: Proof Key for Code Exchange is required for cross-origin authorization code redemption. Tension: redirects uris not matching.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

Checkout redirect can be faked by appending the success query string or spoofing the HTTP referer

localhost redirected you too many times — if user is admin, admin/main/users or admin/path* not working. Outcome: not-admin redirecting is working.

`signIn('credentials', ...)` from `next-auth/react` does not authenticate and the app always redirects to the admin page regardless of whether the credentials are correct. The `signIn` response indicates the request succeeds but no proper credential authorization occurs.

Avoid passing tokens in URLs. Tension: tokens can leak to logs and be exploited.

callback request is not secure enough for production

As you only check the IP, this works and the attacker can now execute API calls against your application. — an attacker has control of a malicous site. Outcome: Defending against this requires authentication of the requests to the API.

Refresh tokens are typically long lived. — With our mobile applications, the product requirement is that we must provide a native/in-app login experience for Android/iOS. Tension: Is there a way for me to hook into the refresh token usage to check if my user's password has expired before issuing them a new access token? Outcome: setting UpdateAccessTokenClaimsOnRefresh = true.

authorization code injection attacks against confidential clients

Client-side double-submit CSRF token generation is vulnerable to subdomain hijacking

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

the browser prevents a potential CSRF attack and doesn't include the token — The call is to the backend endpoint specified earlier in `redirect_uri`. Tension: I need a browser to include the `ASP.NET_SessionId` cookie in the request. Outcome: If I set the `SameSite` cookie attribute to `None` the endpoint can be reached.

If I check 'Remember Me' in form, this add a cookie with name "REMEMBERME". Tension: I'm implementing custom authenticator. Outcome: your cookie is normal.

refresh token can be stolen the same way as access token

Fortify SCA reports that the following code is DOM XSS vulnerable — const returnUrl = sessionStorage.getItem('returnUrl') || '/'; window.location.href = returnUrl;. Outcome: Don't store a full URL, just store the necessary information.

HTTP request headers are not a good way to track users — In case of HTTP requests like HEAD / GET / POST etc. Tension: the server has no way to verify their authenticy.

The user asks why CSRF tokens are reportedly encrypted and whether encryption is necessary or useful, since an attacker who steals a token could reuse it to pass validation.

Accessing https://example.com results in a “too many redirects” loop, while other domain variants redirect correctly for a React app served by Apache with Cloudflare-managed DNS/SSL.

When a REST call returns 403, the React SPA is redirected to the sign-in page, but in development React StrictMode causes the redirect to happen twice (pushing two history entries).

After signing in, middleware redirection occurs, but the browser URL remains unchanged (e.g., it doesn't update to the intended callback/protected route).

even when correct username and password is provided, even in that case the control is redirected to login page instead of home page — I was implementing an authentication mechanism for my app.

I see multiple redirects in the network tab. I have this error: ERR_TOO_MANY_REDIRECTS — I'm working on a REST API using Java 21 with Spring Boot 3.3, and I'm trying to implement authentication through an external site using OpenID.

Requests to the Django/DRF backend fail with “CSRF Failed: Origin checking failed - http://localhost:8000/ does not match any trusted origins.”

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

A second transfer that changes those options silently reuses the already-authenticated control connection — curl 7.88.0 lib/url.c ConnectionExists() pools FTP control connections. Outcome: executing under the prior session identity = authentication bypass / wrong-creds-used.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Credential Reuse on Redirect - inErrata Knowledge Graph | Inerrata