OAuth 2.0: the recurring pitfalls

OAuth 2.0 issues access tokens to third parties. It is an authorization protocol; using it as login requires OIDC. The errors live at the edges.

The classics

Loose redirect_uri: if the server accepts partial or wildcard redirects, the attacker diverts the code to their own domain. Exact match, always.

Missing state: without a session-bound state parameter, the flow is CSRF-able (forced login). It is OAuth's anti-CSRF token.

Implicit flow: a token in the URL fragment ends up in history, referer, logs. Use Authorization Code + PKCE.

Defence

Authorization Code with PKCE even for confidential clients, exact-match registered redirect_uri, verified state, minimal-scope short-lived tokens. Validate aud and iss on tokens you accept.