> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-login-bypass-via-implicit-flow.md).

# 通过隐式流程绕过 OAuth 登录

### 通过 OAuth 隐式流程绕过身份验证

#### 实验上下文

本实验使用一个 **OAuth** 提供商来启用通过社交网络账户进行连接。/ 由于对……的不足 **对客户端应用程序的验证**，可以连接到另一个用户账户 **而无需知道其密码**.

目标：以……身份连接 **carlos** （电子邮件： `carlos@carlos-montoya.net`）。/ 可用的社交媒体账户： `wiener:peter`.

#### 观察

* 当尝试登录时，应用程序会重定向到一个 OAuth 页面：
  * *“我们现在正在将您重定向到通过社交媒体登录...”*

<figure><img src="/files/92ce8de285d1f9611930b035891ddfa90377036b" alt=""><figcaption></figcaption></figure>

* 在 OAuth 域进行身份验证并接受权限（个人资料 + 电子邮件）后，应用程序随后会向一个内部端点发送请求，通常是：
* `POST /authenticate`

<figure><img src="/files/9161c7aad3f188a7dc69f451dea225db8aac442f" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/2654b1923529b71bc6e15598e4693124a1d316f4" alt=""><figcaption></figcaption></figure>

* 该请求包含如下类型的 JSON：

{% code overflow="wrap" %}

```json
{
"email":"wiener@hotdog.com",
"username":"wiener",
"token":"MkydN3cYAC6wsKXQJEd5tD3kW1nB9MoWqzdfhyL6BtE"
}
```

{% endcode %}

关键点：应用程序 **信任** 该 `email` 和 `username` 客户端传输的字段，而不是 **严格地** 将这些值关联到 `令牌`.

```json
{
"email":"carlos@carlos-montoya.net",
"username":"carlos",
"token":"MkydN3cYAC6wsKXQJEd5tD3kW1nB9MoWqzdfhyL6BtE"
}
```

#### 利用

1. 通常使用该账户通过 OAuth 连接 **wiener**.
2. 拦截发送到 `POST /authenticate`.
3. 仅更改身份字段，保持相同的 `令牌`:

<figure><img src="/files/07ab4db887f3de5d4ac56dab98f196e7e5d39402" alt=""><figcaption></figcaption></figure>

4. 发送修改后的请求。

#### 结果

* 服务器响应 **`302 Found`**，这表明会话已创建，并且应用程序认为该用户已通过身份验证。
* 然后我们得到一个会话 \*\*以 Carlos 身份连接\*\*。

<figure><img src="/files/2a4918c91a19f9f6fe8557a6d05e9ccbb3075431" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-login-bypass-via-implicit-flow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.