Backend OAuth Security — Securing OAuth 2.0 Implementations

// Secure OAuth 2.0 client
class SecureOAuthClient {
  constructor(config) {
    this.clientId = config.clientId;
    this.clientSecret = config.clientSecret;
    this.redirectUri = config.redirectUri;
    this.authorizationEndpoint = config.authorizationEndpoint;
    this.tokenEndpoint = config.tokenEndpoint;
  }

  generateAuthorizationUrl() {
    const state = crypto.randomBytes(32).toString('hex');
    const codeVerifier = base64url(crypto.randomBytes(32));
    const codeChallenge = base64url(
      crypto.createHash('sha256').update(codeVerifier).digest()
    );

    const params = {
      response_type: 'code',
      client_id: this.clientId,
      redirect_uri: this.redirectUri,
      state,
      code_challenge: codeChallenge,
      code_challenge_method: 'S256',
      scope: 'openid profile email'
    };

    return {
      url: `${this.authorizationEndpoint}?${new URLSearchParams(params)}`,
      state,
      codeVerifier
    };
  }

  async exchangeCode(code, state, expectedState, codeVerifier) {
    // Validate state (CSRF protection)
    if (state !== expectedState) {
      throw new Error('State parameter mismatch - possible CSRF attack');
    }

    // Validate redirect URI (prevent open redirect)
    const allowedRedirects = [this.redirectUri];
    // ... validate

    // Exchange code with PKCE
    const response = await axios.post(this.tokenEndpoint, {
      grant_type: 'authorization_code',
      code,
      redirect_uri: this.redirectUri,
      client_id: this.clientId,
      code_verifier: codeVerifier
    });

    return response.data;
  }

  async refreshToken(refreshToken) {
    // Refresh token rotation
    const response = await axios.post(this.tokenEndpoint, {
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: this.clientId,
      client_secret: this.clientSecret
    });

    return response.data;
  }
}

// Redirect URI validation
function validateRedirectUri(uri) {
  const parsed = new URL(uri);
  const allowed = [
    'https://app.example.com/callback',
    'https://app.example.com/auth/callback'
  ];

  if (!allowed.includes(parsed.origin + parsed.pathname)) {
    throw new Error('Invalid redirect URI');
  }

  if (parsed.hash) {
    throw new Error('Fragment not allowed in redirect URI');
  }

  return true;
}