The post explains OAuth from first principles by progressively improving a flawed implementation and addressing various security attacks. It takes a user from initial insecure methods of third-party app authorization to the secure OAuth 2.0 authorization code flow with PKCE. Real-world examples illustrate common vulnerabilities
Table of contents
The world without OAuthAttack #1: Big Head's credentials are exposedAttack #2: Anyone can just claim to be anyone elseAttack #3: Redirect URI manipulationAttack #4: Cross-site request forgery (CSRF)Attack #5: Eavesdropping access tokensAttack #6: Eavesdropping authorization codesAttack #7: Redirect URI manipulation on trusted URIsThe final flowSome final notes2 Comments
Sort: