Transport.RoundTrip unconditionally injects the Authorization header on
every call, including intermediate calls http.Client makes for each
redirect hop. Go's http.Client strips the Authorization header before
building a cross-host redirect request, but oauth2.Transport re-adds the
token immediately, forwarding it to every host in the redirect chain.
Any application that uses NewClient and follows cross-host redirects will
forward its OAuth bearer token to the redirect destination. An attacker
who controls a redirect (via an open redirect on the target API, a DNS
hijack, or a user-controlled URL) can steal the token.
Fix tracked in #804.
Transport.RoundTrip unconditionally injects the Authorization header on
every call, including intermediate calls http.Client makes for each
redirect hop. Go's http.Client strips the Authorization header before
building a cross-host redirect request, but oauth2.Transport re-adds the
token immediately, forwarding it to every host in the redirect chain.
Any application that uses NewClient and follows cross-host redirects will
forward its OAuth bearer token to the redirect destination. An attacker
who controls a redirect (via an open redirect on the target API, a DNS
hijack, or a user-controlled URL) can steal the token.
Fix tracked in #804.