Hacker News Reader

It wasn't to me either. I think it has something to do with the 302 redirect. I've never used FB Connect though, so maybe the 302 involves the fb/connect url? Replace your FB url with the victim's, and since you've already authenticated with FB, the web site will accept your token as authorization to the victim's account?

View on HN

302 redirects preserve the URL's hash, which contains the access token in the JS SDK.

Thus, if a site has URLs that can be constructed to make a 302 to an attacking site, like https://www.google.com/redirect?url=http://www.example.com/, it's possible to craft a redirect URL that would take you to the authentication dialog but return the token to a redirect URL which will in turn pass the token to the attacker.

Reply on news.ycombinator.com