Implicit Flow Detector
TL;DR: This browser extension is now available in both the Google Chrome Webstore and the Firefox Addons.
This browser extension detects websites that use the implicit flow. It does this by scanning urls and looking for
access_token in the url.
It works on both Firefox and Chrome. It should work on chromium variants. It doesn't work on Safari.
If the implicit flow is detected, the site url will be added to a tree view in the extension popup. Expanding that tree shows you the token contents. It also shows a yellow indicator for the presence of an id token and a red indicator for the presence of an access token.
browser-polyfill.js, which makes chrome adhere to the standard for browser extensions that mozilla has proposed. This enables it to be a single codebase that works in both chrome and firefox.
npm install --global web-ext
Launch firefox and chrome to test:
web-ext run -t chromium -t firefox-desktop
Install in Browsers
You can also install it locally by following these instructions:
Click the hamburger menu in the upper right. Select Add-ons. Click the gear icon. Select Debug Add-ons. Click Load Temporary Add-on.... Select the implicit-flow-detector-0.1.zip file.
Click the vertical three dots in the upper right. Select More tools > Extensions. Click the Developer mode slider mode in the upper right. Click the Load unpacked button. Select the folder this README is in.
See it in Action
- The icon for the extension is a blue hash symbol. Navigate to: https://okta-oidc-fun.herokuapp.com
- Uncheck code and check id token and access token
- Click the link the at the bottom of the page
- Notice that the extension icon changes from blue to red to indicate that an implicit flow has been detected
- Click the red hash icon and you'll see
https://okta-oidc-fun.herokuapp.comin the list
NOTE: If you do the medium.com example, you'll see that they use an opaque access token and a JWT ID Token. The browser add-on represents these accordingly. It should work with any site that uses the implicit flow.
Good sites for testing
The following urls use the implicit flow and will result information showing in the browser extension:
- make sure access token and/or id token are checked
- login with google
Building for Release
- go to the google chrome dashboard to publish the updated version
- go to the firefox add-ons dashboard to publish the updated version
- Show a badge with the number of sites detected
cleanup iconography and style show the raw tokens in popup show "yellow alert" icon if only id token is detected show "red alert" icons if access token is detected if token(s) are jwts, show claims pretty print claims if present