The mistakes that cause breaches

OAuth 2.0 Course · lesson 8 of 13 · 4 min read

Five errors that turn a correct-looking OAuth integration into a vulnerability.

Open this lesson in the learning hub

Key points

  • Not validating state on the callback - this is a CSRF hole, and it is the most commonly skipped check.
  • Registering a wildcard or overly broad redirect_uri, letting an attacker redirect the code to themselves.
  • Using the implicit grant, which puts the access token in the URL fragment where it is logged and shared.
  • Storing tokens in localStorage, where any XSS on the page can read them.
  • Not validating aud on the resource server - accepting a token minted for a different API.

Validate state and pin redirect_uri exactly - those two checks stop the most common OAuth attacks.

Access tokens and refresh tokens Public and confidential clients

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.