Bypassing GitHub's OAuth Flow with a Head Request
In the proof of concept[1]:1. Send an ajax HEAD request, which grants the permissions.2. However, since the HEAD response doesn't have valid CORS headers, you can't read the 'code' parameter from the HEAD response.3. To get around CORS, the proof-of-concept redirects the user to the same OAuth url again.4. Since the user has already authorized the scope (from the previous HEAD request), Github automatically redirects back to the redirect_uri (the proof-of-concept page) with a new 'code' that the author can then use.So I have two questions:a) If I have 3rd party cookies disabled, will the "credentials: 'include'," part of the ajax HEAD request still work?b) Why does Github automatically redirect back the 2nd time without asking the user to authorize again? I thought it was best practice to ask the user to click authorize every time even if they're authorizing the same scope they previously authorized?[1]: https://not-an-aardvark.github.io/oauth-bypass-poc-fbdf56605...