600271 - Remove oauth_token and oauth_verifier from URL

Status: VERIFIED FIXED

(support.mozilla.org :: Army of Awesome, task)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

After twitter authentication the user is redirected back to the customer care page along with the oauth_token and oath_verifier values in the URL as arguments. (token values shortened in example)

Example:
 https://master.support.mozilla.com/en-US/army-of-awesome?twitter_auth_request=1&oauth_token=aBUV0cT&oauth_verifier=fXKoOZ8

This communication is over HTTPS and there is no concern of malicious interception of this data. However, users often copy and paste URLs to share a page with others. This could inadvertently disclose the two pieces of data that could be used to assist an attacker.

Recommended Remediation
1. First investigate if it is possible to instruct twitter to send this data back via POST parameters or header values.
2. If option 1 is not possible then modify the application to automatically redirect the user back to a "clean" url that does not contain the token values. This still exposes the token values within the browser history, but mitigates the primary concern of inadvertent "copy and paste" disclosure.

Comment 1

[Alex Buchanan [:abuchanan]]

http://github.com/jsocol/kitsune/commit/9fd5b8bb04b8926b1ac46f8bcc19288fff62ed8d#diff-4

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

Verified fixed on https://master.support.mozilla.com. Marking verified.