Is Discord Token Login safe?

Medium risk

Discord Token Login passes your Discord auth token through the URL bar, exposing it in browser history and server logs.

When a user submits their Discord token via the extension popup, the extension opens a new tab with the token appended as a URL query parameter (discordtoken=). A content script on discord.com reads the token from the URL, clears all existing cookies and localStorage, and injects the token as the active session credential. Because the token appears in the URL, it is recorded in the browser's history and can appear in HTTP Referer headers sent to third-party resources on the page.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

flxderv3.2Chrome Web Store
42Risk
Who publishes it

flxder - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
flxder
Website
ko-fi.com/flxderdev

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension wipes all Discord cookies on every page load

The extension injects a cookie-deletion script into every discord.com page at document_start, before Discord's JS runs, wiping all cookies.

A discordtoken URL parameter also clears localStorage and writes that token as the sole key.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any discord.com URL, including your normal Discord session.

No extension interaction is required. The content script is declared with run_at: document_start and matches all discord.com subdomains.

The extension did this

The content script injects a self-executing script that expires every cookie in document.cookie before Discord's own JavaScript runs.

This occurs unconditionally on every page load, not only during token-login flows.

The code that does this

Unconditional cookie wipe (content.js:1-17) and conditional localStorage wipe (content.js:22-28)

Readable version
// Lines 1-17: unconditional — fires on every discord.com page load// Builds and injects a <script> tag that expires all cookies:function deleteAllCookies() {    var cookies = document.cookie.split(";");    for (var i = 0; i < cookies.length; i++) {        var cookie = cookies[i];        var eqPos = cookie.indexOf("=");        var name = eqPos > -1 ? cookie.substr(0, eqPos) : cookie;        document.cookie = name + "=;expires=Thu, 01 Jan 1970 00:00:00 GMT";    }}deleteAllCookies();// Lines 22-28: conditional — fires only when discordtoken URL param is presentconst urlParams = new URLSearchParams(window.location.search);var discordtoken = urlParams.get("discordtoken");if (discordtoken) {    localStorage.clear();    localStorage.setItem('token', `"${discordtoken.replace('"', '')}"`);    window.location.replace('https://discord.com/channels/@me');}
Page DOM modified

All cookies are expired (document.cookie becomes empty string). All localStorage keys are removed and replaced with a single token key, the user-supplied value from the discordtoken URL parameter.

Target
Discord cookies and localStorage on any discord.com page
Before
document.cookie = "__dcfduid=abc123; __sdcfduid=def456; locale=en-US"localStorage = { "token": "\"MTEx...\"", "preferredLocale": "en-US", "lastGuild": "123456789" }
After the extension changed it
document.cookie = ""localStorage = { "token": "\"MFA.<test marker value>.fake_discord_token_value\"" }
Unconditional scope of cookie deletion

The localStorage wipe is gated on the discordtoken URL parameter, so it only occurs during a token-login flow. The cookie deletion, however, runs on every discord.com page load — including ordinary browsing sessions where no token login is taking place. A user who installs this extension and then visits Discord normally will have their cookies wiped on each navigation, potentially disrupting their active session.

Updated 30 September 2026hifcahjlgbmhppcoppikpcceognjcjjp