L27 · OAUTH 2.0
Catch a forged response
Tamper with the state value on the demo client and watch it refuse the callback.
Planned
Steps
Sign in to the demo client normally.
What the server will check: The demo client accepted a matching state value.
Change the state value in the callback address before it loads.
What the server will check: The demo client rejected the callback.
The client refuses any response it did not ask for. That check belongs to the client, which is why the demo client carries it.
When it opens
This lab is planned. It opens when these are in place:
- The demo client application
The demo client records what it accepted and rejected for your attempt.