TL;DR
: This browser extension is now available in both the Google Chrome Webstore and the Firefox Addons.
This browser extension detects websites that use the implicit flow. It does this by scanning urls and looking for id_token
and/or access_token
in the url.
It works on both Firefox and Chrome. It should work on chromium variants. It doesn't work on Safari.
If the implicit flow is detected, the site url will be added to a tree view in the extension popup. Expanding that tree shows you the token contents. It also shows a yellow indicator for the presence of an id token and a red indicator for the presence of an access token.
The code is vanilla javascript. There is one dependency: browser-polyfill.js
, which makes chrome adhere to the standard for browser extensions that mozilla has proposed. This enables it to be a single codebase that works in both chrome and firefox.
Install web-ext
with:
npm install --global web-ext
Launch firefox and chrome to test:
web-ext run -t chromium -t firefox-desktop
The extension is available for Google Chrome and Firefox.
You can also install it locally by following these instructions:
Click the hamburger menu in the upper right. Select Add-ons. Click the gear icon. Select Debug Add-ons. Click Load Temporary Add-on.... Select the implicit-flow-detector-0.1.zip file.
Click the vertical three dots in the upper right. Select More tools > Extensions. Click the Developer mode slider mode in the upper right. Click the Load unpacked button. Select the folder this README is in.
- The icon for the extension is a blue hash symbol. Navigate to: https://okta-oidc-fun.herokuapp.com
- Uncheck code and check id token and access token
- Click the link the at the bottom of the page
- Notice that the extension icon changes from blue to red to indicate that an implicit flow has been detected
- Click the red hash icon and you'll see
https://okta-oidc-fun.herokuapp.com
in the list
Bonus:
You can see additional sites added to the implicit flow detector by going to: OAuth.com Implicit Flow playground and/or Medium post on Implicit Flow.
NOTE: If you do the medium.com example, you'll see that they use an opaque access token and a JWT ID Token. The browser add-on represents these accordingly. It should work with any site that uses the implicit flow.
The following urls use the implicit flow and will result information showing in the browser extension:
- https://okta-oidc-fun.herokuapp.com
- make sure access token and/or id token are checked
- https://www.oauth.com/playground/implicit.html
- https://medium.com/@nilasini/real-world-example-to-understand-oidc-implicit-flow-ecdf1b1d0156
- login with google
- run:
web-ext
build - go to the google chrome dashboard to publish the updated version
- go to the firefox add-ons dashboard to publish the updated version
- Show a badge with the number of sites detected
cleanup iconography and styleshow the raw tokens in popupshow "yellow alert" icon if only id token is detectedshow "red alert" icons if access token is detectedif token(s) are jwts, show claimspretty print claims if present