OAuth2
potential attacks
weak redirect_uri configuration
- other parameters might be vulnerable too: client_uri, policy_uri, tos_uri, initiate_login_uri
- .well_known/openid-configuration/ can contain information about endpoints
xss in redirect implementation
state parameter is not random
- does not work as CSRF protection anymore
- send your registration link to their account
- allow login with your additional external account
pre-account takeover
- try to create one account before the use links their account
- now the new user account is linked to an existing attacker account
Everlasting authorization code
pkce
- adds a code_challenge / verification to the Oauth2 flow
- prevents a captured code from being used to gain the access token
- references
references