I have a React App that is using implicit flow to authorize the user.
The flow goes like this: 1. If no access token or user info saved in sessionStorage - user gets redirected to the login page. 2. User logs in and gets redirected to the home page of React App. 2.1. When redirecting back to home page redirect URL already has access_token and id_token as part of url params. 3. React App saves access token and decodes id_token to get info about the user.
Now the problem is that if somebody steals redirect URL in 2.1. they can paste it in their browser and basically replay this login.
One of the solutions was to implement nonce.
https://auth0.com/docs/api-auth/tutorials/nonce
As per article above nonce should be stored in localStorage and once I get id_token back with nonce in it - I should validate it with original nonce from localStorage. But the attacker can do the following: 1. Take this id_token. 2. Decode it using any online tool. 3. Check what kind of nonce was in it. 4. Using Chrome Dev Tool modify hist localStorage with needed nonce.
Does anybody know any better ideas of preventing such attack?
