OAuth2 Attacks — Common Attack Vectors and How to Defend Against Them

In this tutorial, you will learn about OAuth2 Attacks. We cover key concepts, practical examples, and best practices to help you master this topic.

OAuth2 faces several attack vectors including CSRF, code interception, open redirectors, mix-up attacks, token replay, and consent phishing — each with specific defenses.

What You'll Learn

The major OAuth2 attack types, how they work, and how to prevent each one.

Why It Matters

Understanding OAuth2 attacks is essential for securing implementations. The OAuth2 framework is secure when all mechanisms are correctly implemented. Each attack exploits a missing or misconfigured protection.

Real-World Use

Facebook OAuth vulnerability 2018 (token exposure), Google+ API misuse, numerous CSRF vulnerabilities in custom OAuth implementations. Learning from these helps build secure systems.

flowchart TD
    A["OAuth2 Attacks"] --> B["CSRF\nMissing state parameter"]
    A --> C["Code Interception\nNo PKCE on public client"]
    A --> D["Open Redirector\nWeak redirect URI check"]
    A --> E["Mix-Up Attack\nMultiple auth providers"]
    A --> F["Token Replay\nNo token binding"]
    A --> G["Consent Phishing\nConfusing scope names"]
    style A fill:#fecaca,stroke:#dc2626
    style B fill:#fef3c7,stroke:#d97706
    style C fill:#fef3c7,stroke:#d97706
    style D fill:#fef3c7,stroke:#d97706
    style E fill:#fef3c7,stroke:#d97706
    style F fill:#fef3c7,stroke:#d97706
    style G fill:#fef3c7,stroke:#d97706

Attack Descriptions

Preventing Mix-Up Attacks

If your app works with multiple authorization servers, an attacker can swap the auth server mid-flow. Validate the iss (issuer) claim in tokens and the issuer returned from the token endpoint.

# Prevent mix-up attack — validate the issuer
@app.route("/callback")
def callback():
    code = request.args.get("code")
    # The token endpoint must return the issuer
    token_response = requests.post(TOKEN_URL, data={"code": code, ...})
    issuer = token_response.json().get("iss")
    if issuer != EXPECTED_ISSUER:
        return "Wrong authorization server", 400

Common Mistakes

1. Not Validating the iss Claim

Without issuer validation, a token from a malicious auth server is accepted.

2. Ignoring Token Binding

Token binding ties tokens to specific TLS connections. Without it, tokens can be replayed from different clients.

3. Confusing Scope Permissions

Users approve scopes they do not understand. Use clear names and descriptions.

4. Not Implementing Rate Limiting

Attackers can brute force authorization codes or refresh tokens without rate limits.

5. Logging Sensitive Data

Authorization codes, tokens, and state values in logs can be used by attackers who access log files.

Practice Questions

1. What attack does the state parameter prevent?
2. What attack does PKCE prevent?
3. What is an open redirector attack?
4. What is a mix-up attack?
5. What is consent phishing?

Answers:

1. CSRF — the attacker swaps the authorization code with one they generated.
2. Authorization code interception — the attacker captures the code and cannot exchange it without the verifier.
3. The attacker uses an open redirector on the legitimate app's domain to capture the authorization code from the URL.
4. When an app works with multiple auth providers, the attacker tricks it into using a malicious provider.
5. The attacker creates an app with legitimate-looking scope names that users approve without understanding.

Challenge: Write a security test suite that checks an OAuth2 implementation for all common vulnerabilities. The suite should test state, PKCE, redirect URIs, and issuer validation.

FAQ

Mini Project

Build an OAuth2 Security Testing tool that checks for state, PKCE, redirect URI validation, HTTPS, and token TTL. The tool should simulate each attack and verify the server's defense.

What's Next

Now learn about OAuth2 Bearer Token Usage — how tokens are transmitted and validated.