T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/withings_oauth_login.py:113- Finding
OAuth Authorization Flow Lacks State Validation
- Content
View full analysis
")) tok = exchange_code_for_token( code=code, client_id=client_id, client_secret=client_secret, redirect_uri=redirect_uri, ) ``` The loopback callback also accepts a code without correlating it to the authorization request: ```python q = urllib.parse.parse_qs(parsed.query) code = (q.get("code") or [None])[0] if code: got["code"] = code self.send_response(200) ``` ### Technical Analysis OAuth authorization requests should include a cryptographically unpredictable `state` value that is bound to the local login attempt. The callback must require the same value and reject responses with a missing or mismatched state. This implementation does not generate, transmit, retain, or validate a `state` parameter. Consequently, it cannot distinguish the authorization response initiated by the current user from an unsolicited response delivered to the same callback URI. The copy-and-paste mode has the same weakness because `parse_code()` extracts only the authorization code and does not validate state. Authorization-code protections at the provider may limit exploitability, because the code remains bound to the configured client and redirect URI and should be single-use. They do not provide local request correlation, h ...[truncated 1327 chars]- Remediation
View remediation