Bypassing GitHub's OAuth Flow with a Head Request
In the proof of concept[1]:<p>1. Send an ajax HEAD request, which grants the permissions.<p>2. However, since the HEAD response doesn't have valid CORS headers, you can't read the 'code' parameter from the HEAD response.<p>3. To get around CORS, the proof-of-concept redirects the user to the same OAuth url <i>again</i>.<p>4. Since the user has already authorized the scope (from the previous HEAD request), Github automatically redirects back to the redirect_uri (the proof-of-concept page) with a new 'code' that the author can then use.<p>So I have two questions:<p>a) If I have 3rd party cookies disabled, will the "credentials: 'include'," part of the ajax HEAD request still work?<p>b) Why does Github automatically redirect back the 2nd time without asking the user to authorize again? I thought it was best practice to ask the user to click authorize every time even if they're authorizing the same scope they previously authorized?<p>[1]: <a href="https://not-an-aardvark.github.io/oauth-bypass-poc-fbdf56605489c74b2951/" rel="nofollow">https://not-an-aardvark.github.io/oauth-bypass-poc-fbdf56605...</a>