{"action":"opened","issue":{"url":"https://api.github.com/repos/cloudfoundry/uaa/issues/307","repository_url":"https://api.github.com/repos/cloudfoundry/uaa","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/307/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/307/comments","events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/307/events","html_url":"https://github.com/cloudfoundry/uaa/issues/307","id":132083758,"number":307,"title":"Vulnerable to 307 redirect?","user":{"login":"MatthiasWinzeler","id":474567,"avatar_url":"https://avatars.githubusercontent.com/u/474567?v=3","gravatar_id":"","url":"https://api.github.com/users/MatthiasWinzeler","html_url":"https://github.com/MatthiasWinzeler","followers_url":"https://api.github.com/users/MatthiasWinzeler/followers","following_url":"https://api.github.com/users/MatthiasWinzeler/following{/other_user}","gists_url":"https://api.github.com/users/MatthiasWinzeler/gists{/gist_id}","starred_url":"https://api.github.com/users/MatthiasWinzeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MatthiasWinzeler/subscriptions","organizations_url":"https://api.github.com/users/MatthiasWinzeler/orgs","repos_url":"https://api.github.com/users/MatthiasWinzeler/repos","events_url":"https://api.github.com/users/MatthiasWinzeler/events{/privacy}","received_events_url":"https://api.github.com/users/MatthiasWinzeler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-08T08:51:16Z","updated_at":"2016-02-08T08:51:16Z","closed_at":null,"body":"Recently, a paper describing two new attacks on the OAuth2 protocol was published:\r\nhttp://arxiv.org/pdf/1601.01229v2.pdf\r\n\r\nThe second attack (IdP Mix up) is not relevant for UAA since it does not act as OAuth RP.\r\n\r\nMy question: Is the UAA vulnerable to the first attack in the paper (307 redirect)?\r\nIt seems UAA always uses 302 redirects and is not vulnerable. But is it using 307 redirects under certain circumstances?\r\nDoes it use 307 redirects in its codebase at all? I does not seem like that when scanning through the code."}}