domains / families / security / testing-oauth2-implementation-flaws

testing-oauth2-implementation-flaws

separate

Tests OAuth 2.0 and OpenID Connect implementations for authorization code

When to use

• Assessing OAuth 2.0 authorization code flow for redirect URI validation weaknesses
• Testing OAuth client applications for CSRF protection (state parameter usage) and PKCE enforcement
• Evaluating token storage, transmission, and lifecycle management in OAuth implementations
• Testing scope escalation where clients request more permissions than authorized
• Assessing OpenID Connect implementations for ID token validation and nonce usage

When not to use

• Use without written authorization

Skill page

Source