T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:81- Finding
OAuth Authorization Flow Does Not Validate a CSRF State Parameter
- Content
View full analysis
Authentication successful!You can close this window.
") global auth_code auth_code = params["code"] ``` ```python auth_url = "https://accounts.spotify.com/authorize?" + urlencode({ "client_id": CLIENT_ID, "response_type": "code", "redirect_uri": REDIRECT_URI, "scope": SCOPE, }) ``` ### Technical Analysis The OAuth authorization request does not contain a cryptographically random `state` parameter. The callback handler consequently accepts any `code` parameter without verifying that the callback belongs to the authorization flow initiated by this process. The OAuth `state` parameter binds an authorization response to the browser session and local process that initiated the request. Without this binding, the local callback endpoint cannot distinguish a legitimate response from an attacker-induced response. The callback parsing is also implemented manually rather than with `urllib.parse.urlparse()` and `parse_qs()`. Although this is not the primary vulnerability, standards-compliant parsing would avoid malformed-query and encoding edge cases. ### Attack Path 1. An attacker initiates a Spotify authorization flow using the same public client ID and registered loopback redirect URI. 2. The attacker authorizes the application against a Spotify account control ...[truncated 1374 chars]- Remediation
View remediation