Tag See all →

#express

2 stories

Banner: OAuth token leak via prefix-matched redirect_uri and an open redirect in the next parameter

Security Bug Report

OAuth token leak via prefix-matched redirect_uri and an open redirect in next

Daniel Tran · Sep 9, 2025 · 8 min read

Our partner OAuth server matched redirect_uri by prefix, and our login page followed any next URL. Chained together with a legacy implicit flow, an access token could land on an outside domain. We moved to exact matching, relative-only next and code plus PKCE.

Banner: Stripe webhook fails with no signatures found matching the expected signature for payload

Web Development Bug Report

Stripe webhook fails: No signatures found matching the expected signature for payload

Daniel Tran · Nov 21, 2024 · 9 min read

After a harmless-looking Express refactor, every Stripe webhook failed verification and paid bookings stayed pending. A global JSON parser consumed the body before constructEvent saw it. How we found it, fixed the route and replayed the missed events.