domains / families / security / oauth-oidc-misconfiguration

oauth-oidc-misconfiguration

separate

OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

When to use

• redirect URI validation
• state and nonce handling
• PKCE enforcement
• token audience and issuer checks
• account binding mistakes
• scope handling
• OAuth 2.0 or OpenID Connect flows

When not to use

• token cryptography
• JWT header abuse
• CORS or cross-origin token exposure
• XML federation or enterprise SSO
• CSRF-heavy login or binding bugs

Skill page

Source