OAuth: attacks, flows & security testing

OAuth is an open authorization framework defined in RFC 6749. It allows a third-party application to obtain limited access to a resource on behalf of a user, without exposing credentials. OAuth flows — authorization code, implicit, client credentials, and device — each carry distinct security profiles. The authorization code flow with PKCE is the current recommended standard for public clients. OAuth relies on access tokens and refresh tokens issued by an authorization server. These tokens grant delegated access to protected resources via Bearer authentication headers. Misconfigurations are extremely common in practice. A loose redirect_uri validation allows attackers to intercept authorization codes by redirecting the callback to an attacker-controlled endpoint. Overly broad scopes grant excessive permissions. Insecure token storage in browser localStorage exposes tokens to XSS. Open redirectors in OAuth flows enable token leakage through the Referer header. Understanding these mechanics is essential for both securing OAuth integrations and testing them during security assessments.

Blue Team detection of OAuth abuse starts at the authorization server and API gateway logs. Monitor for authorization requests with unexpected or newly registered redirect_uri values. Alert on authorization codes used more than once — RFC 6749 mandates single use, so reuse strongly indicates interception. Track anomalous token issuance patterns: high-frequency token requests from a single client_id, token requests from unusual geolocations, or client credentials used outside expected IP ranges. On the resource server side, log every Bearer token validation failure. A spike in 401 responses may indicate token enumeration or replay attempts. Enable detailed logging of scope grants — watch for clients requesting elevated scopes beyond their registered profile. In AWS environments, CloudTrail logs OAuth-related API calls. In Entra ID (Azure AD), the Sign-in logs and Audit logs surface OAuth consent grants, including admin consent escalation events. SIEM correlation rules should link consent grant events with subsequent privileged API calls occurring within a short time window. Anomalous refresh token usage — such as the same token being exchanged from two distinct user-agents — is a reliable indicator of token theft.

Red Team OAuth testing focuses on redirect_uri manipulation, token leakage, and consent phishing. Start by probing redirect_uri validation: test open redirectors on the legitimate domain, path traversal variants, and subdomain takeover opportunities. If the server performs only prefix matching, appending a controlled path may bypass validation. For authorization code flows without PKCE, test code interception via Referer header leakage or malicious OAuth integrations. Tools like BurpSuite's OAuth scanner and the open-source oauth2-proxy test harness assist in mapping flow behaviour. Test token storage in the client application — tokens in localStorage are accessible to any JavaScript running on the page, making XSS a direct path to account takeover. Inspect JWT access tokens for weak signing algorithms (none, HS256 with a guessable secret) using jwt_tool. On the hardening side, enforce strict redirect_uri matching with no wildcards. Require PKCE for all public clients. Set short access token lifetimes (under 15 minutes) and rotate refresh tokens on each use. Apply least-privilege scopes. Enable consent screen review workflows and restrict third-party OAuth app installations to vetted applications only.