Post

Scope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec