OAuth Wikipedia

OAuth authorization servers regularly redirect users to other websites (the clients), but they must do so safely.¶ Moreover, given the ratio of clients to authorization and resource servers, it is considered the more viable approach to move as much as possible security-related logic to those servers. Results of OAuth-related security research (see, for example, research.ubc and research.cmu) indicate a large portion of client implementations do not or fail to properly implement security controls, like state checks. Using mutual TLS for OAuth 2.0 RFC8705, on the other hand, allows a client to use the access token at multiple resource servers.¶ Still, since every access token is bound to a specific resource server, the client also needs to obtain a single resource server-specific access token when accessing several resource servers. The mechanism in RFC8707 can be used for this or the information can be encoded in the scope value (Section 3.3 of RFC6749).¶

• In an OAuth2 authorization request, in addition to the client id, what is also submitted to the authorization server?
• If the authorization response is sent with in-browser communication techniques like postMessage WHATWG.postmessage_api instead of HTTP redirects, messages may inadvertently be sent to malicious origins or injected from malicious origins.¶
• In the attack scenario described in Section 4.5.1, the legitimate client would use the correct redirection URI it always uses for authorization requests.
• They also add to the security of OAuth, since they allow the authorization server to issue access tokens with a short lifetime and reduced scope, thus reducing the potential impact of access token leakage.¶
• It is therefore RECOMMENDED that authorization servers publish OAuth Authorization Server Metadata according to RFC8414 and that clients make use of this Authorization Server Metadata (when available) to configure themselves.¶

Refresh tokens are an attractive target for attackers because they represent the full scope of access granted to a certain client, and they are not further constrained to a specific resource. They also add to the security of OAuth, since they allow the authorization server to issue access tokens with a short lifetime and reduced scope, thus reducing the potential impact of access token leakage.¶ For example, it is standard practice of reverse proxies to accept X-Forwarded-For headers and just add the origin of the inbound request (making it a list). While the headers are often custom, application-specific headers, standardized header fields for client certificates and client certificate chains are defined in RFC9440.¶ (In practice, however, most user agents will only show this behavior for 307 redirects.)¶ For all other status codes, including the popular 302, user agents can opt not to rewrite POST to GET requests, thereby causing the user’s credentials to be revealed to the client.

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. OAuth is limited in granularity to the coarse functionality (the scopes) exposed by the target service. OAuth can be used in conjunction with XACML, where OAuth is used for ownership consent and access delegation whereas XACML is used to define the authorization policies (e.g., managers can view documents https://www.downloadwasp.com/13141/download-flexhex.html in their region).

Note

For this reason, authorization servers SHOULD allow administrators to configure allowed origins for particular clients and/or for clients to register these dynamically.¶ https://womenbabe.com/society/page/2 This prevents framing by unauthorized origins in user agents that support CSP. To be effective, CSP must be used on the authorization endpoint and, if applicable, other endpoints used to authenticate the user and authorize the client (e.g., the device authorization endpoint, login pages, error pages, etc.). In addition to those, authorization servers SHOULD also use Content Security Policy (CSP) level 2 W3C.CSP-2 or greater.¶

OAuth 2.0 Security Best Current Practice

Clients MUST check that the authorization response was received from the correct issuer by comparing the distinct redirection URI for the issuer to the URI where the authorization response was received on. When receiving the authorization response, the client MUST compare the received issuer identifier to the stored issuer identifier. This defense requires that the authorization server sends its issuer identifier in the authorization response to the client. It is important to note that just storing the authorization server URL is not sufficient to identify mix-up attacks. In scenarios where an OAuth client interacts with two or more authorization servers, however, clients MUST prevent mix-up attacks. Mix-up attacks can occur in scenarios where an OAuth client interacts with two or more authorization servers and at least one authorization server is under the control of the attacker.

• Otherwise, one-time use CSRF tokens carried in the state parameter that are securely bound to the user agent MUST be used for CSRF protection (see Section 4.7.1).¶
• Refresh tokens are an attractive target for attackers because they represent the full scope of access granted to a certain client, and they are not further constrained to a specific resource.
• Note that this implementation is deliberately vulnerable – we’ll teach you how to exploit this later.
• When the status code 307 is used for redirection instead, the user agent will send the user’s credentials via HTTP POST to the client.¶
• In OpenID Connect, the attack can be mitigated, as the authorization response additionally contains an ID Token containing the at_hash claim.

Resource Owner (User)

• OAuth can be used in conjunction with XACML, where OAuth is used for ownership consent and access delegation whereas XACML is used to define the authorization policies (e.g., managers can view documents in their region).
• If the origin and integrity of the authorization request containing the redirection URI can be verified, for example, when using RFC9101 or RFC9126 with client authentication, the authorization server MAY trust the redirection URI without further checks.¶
• For both defenses, clients MUST store, for each authorization request, the issuer they sent the authorization request to and bind this information to the user agent.
• The service that verifies the user’s identity and issues access/refresh tokens.
• Under the conditions described in Section 4.15.1, authorization servers SHOULD NOT allow clients to influence their client_id or any other claim that could cause confusion with a genuine resource owner.¶
• In particular, access tokens SHOULD be audience-restricted to a specific resource server or, if that is not feasible, to a small set of resource servers.

Where this cannot be avoided, authorization servers MUST provide other means for https://e-beginner.net/what-software-helps-with-project-management/ the resource server to distinguish between the two types of access tokens.¶ This attack potentially affects not only implementations using RFC9068, but also similar, bespoke solutions.¶ If the resource server cannot properly distinguish between access tokens obtained with involvement of the resource owner and those without, the client may accidentally be able to access resources belonging to the resource owner.¶ For example, if a client is able to choose its own client_id during registration with the authorization server, a malicious client may set it to a value identifying a resource owner (e.g., a sub value if OpenID Connect is used). If both options are possible, a resource server may mistake a client’s identity for the identity of a resource owner. In cases of access tokens obtained through grants where no resource owner is involved, such as the client credentials grant, the value of «sub» SHOULD correspond to an identifier the authorization server uses to indicate the client application.¶

Read more

If an external OAuth service is used, you should be able to identify the specific provider from the hostname to which the authorization request is sent. Doing some basic recon of the OAuth service being used can point you in the right direction when it comes to identifying vulnerabilities. Although there are a handful of mandatory components required for the basic functionality of each grant type, the vast majority of the implementation is completely optional. OAuth authentication vulnerabilities arise partly because the OAuth specification is relatively vague and flexible by design.