OAuth misconfigurations lead to account takeovers.
Common Vulnerabilities
- Open redirect attacks
- CSRF in OAuth flow
- Token leakage
- Insufficient scope validation
- Insecure state parameterBest Practices
- Validate redirect URIs strictly
- Use PKCE for public clients
- Short-lived access tokens
- Secure token storage
- Implement token bindingSecurity Headers
- Use state parameter
- Implement nonce
- Validate ID tokens
- Check token audience