Social OAuth authorization code (rtCode) transmitted as URL query parameter #375

Summary

The social authentication flow passes the OAuth authorization code as a query string parameter (?rtCode=...) rather than in the POST body. Query parameters appear in:

• Server access logs
• Browser history
• Referrer headers sent to third-party scripts on the destination page
• Proxies and CDN logs

This can expose short-lived but sensitive OAuth codes before they are exchanged for tokens.

Location

apps/public-api/src/routes/userAuth.js and the corresponding controller in userAuth.controller.js.

Impact

• An attacker who obtains the rtCode before it is consumed can exchange it for an access token and hijack the account.
• OAuth 2.0 best-practice (RFC 6749 Section 10.5) explicitly warns against transmitting authorization codes in URLs.

Suggested Fix

Accept rtCode exclusively via a POST request body:

// Instead of GET /auth/social?rtCode=...
// Use POST /auth/social with body { rtCode: '...' }
router.post('/social', asyncHandler(socialAuthController));