OAuth and OIDC

  1. Security Considerations and Threats
    1. Common Attack Vectors
      1. Cross-Site Request Forgery
        1. Attack Mechanism
          1. OAuth-Specific Risks
            1. Mitigation Strategies
            2. Authorization Code Interception
              1. Attack Scenarios
                1. Mobile App Vulnerabilities
                  1. Prevention Techniques
                  2. Token Leakage
                    1. Storage Vulnerabilities
                      1. Transmission Risks
                        1. Browser-Based Risks
                          1. Logging and Debugging Risks
                          2. Replay Attacks
                            1. Token Reuse Scenarios
                              1. Time-Based Attacks
                                1. Prevention Mechanisms
                                2. Phishing Attacks
                                  1. Fake Authorization Servers
                                    1. User Education
                                      1. Technical Mitigations
                                      2. Open Redirect Attacks
                                        1. Redirect URI Manipulation
                                          1. Validation Requirements
                                        2. Essential Security Mechanisms
                                          1. State Parameter
                                            1. CSRF Protection
                                              1. Request Correlation
                                                1. Implementation Requirements
                                                2. Nonce Parameter
                                                  1. Replay Attack Prevention
                                                    1. ID Token Binding
                                                      1. Generation Requirements
                                                      2. PKCE Implementation
                                                        1. Universal Application
                                                          1. Code Verifier Security
                                                            1. Challenge Method Selection
                                                            2. Redirect URI Validation
                                                              1. Exact Matching Requirements
                                                                1. Wildcard Restrictions
                                                                  1. Security Implications
                                                                2. Token Security Best Practices
                                                                  1. Short-Lived Access Tokens
                                                                    1. Risk Reduction
                                                                      1. Refresh Token Usage
                                                                        1. Expiration Strategies
                                                                        2. Secure Token Storage
                                                                          1. Client-Side Storage
                                                                            1. Server-Side Storage
                                                                              1. Memory-Only Storage
                                                                              2. Token Transmission Security
                                                                                1. HTTPS Requirements
                                                                                  1. Header vs Body Placement
                                                                                    1. Logging Considerations
                                                                                    2. Token Revocation
                                                                                      1. Immediate Revocation
                                                                                        1. Cascade Revocation
                                                                                          1. Notification Mechanisms

                                                                                      Previous

                                                                                      8. JSON Web Tokens in OAuth and OIDC

                                                                                      Go to top

                                                                                      Next

                                                                                      10. Advanced OAuth and OIDC Topics