Covert Redirect Vulnerability with OAuth 2

tl;dr Covert Redirect Vulnerability is a real, if not new, threat when combined with Implicit Grant Flow (not Code flow)

This Covert Redirect Vulnerability in OAuth 2 is an interesting one.

There’s a couple of defending arguments that this isn’t a flaw in OAuth itself.

While I agree that…