Initial PoC of spoofing Android OAuth

This commit is contained in:
Matthew Esposito 2023-06-05 20:31:25 -04:00
parent ba89b76332
commit 383d2789ce
No known key found for this signature in database
5 changed files with 94 additions and 5 deletions

View file

@ -6,6 +6,7 @@
mod config;
mod duplicates;
mod instance_info;
mod oauth;
mod post;
mod search;
mod settings;
@ -25,6 +26,8 @@ use once_cell::sync::Lazy;
use server::RequestExt;
use utils::{error, redirect, ThemeAssets};
use crate::client::OAUTH_CLIENT;
mod server;
// Create Services
@ -167,6 +170,11 @@ async fn main() {
Lazy::force(&config::CONFIG);
Lazy::force(&instance_info::INSTANCE_INFO);
// Force login of Oauth client
#[allow(clippy::await_holding_lock)]
// We don't care if we are awaiting a lock here - it's just locked once at init.
OAUTH_CLIENT.write().unwrap().login().await;
// Define default headers (added to all responses)
app.default_headers = headers! {
"Referrer-Policy" => "no-referrer",