Clowder OAuth 2.0 Demo
This server demonstrates an OAuth authorization code flow.
Registered redirect URIs
Client app is registered with redirect URI prefix:
http://app.example.test
Validation uses prefix matching — any URI starting with that prefix is accepted.
Simulate the attack
Craft an authorization URL with a redirect_uri that starts with the allowed prefix but redirects to an attacker-controlled domain.
Example: http://app.example.test.attacker.test/steal