oauth

OAuth Detection

Overview

OAuth is a delegated-authorization framework that applications routinely repurpose as a login mechanism: the client sends the user to an authorization server, receives a code or token back through the browser, and treats what it learns from that credential as proof of identity. Everything sensitive — the authorization code, the access token, the identity claims — travels through the victim's browser across redirects, which is exactly where it can be diverted, swapped, or replayed. The attacker is usually an unauthenticated outsider who lures the victim into completing a crafted authorization request, or a registrant who abuses loose validation on the provider side; what they gain is a session as the victim on the client application, data within the token's scope, or, on the provider side, outbound reach from the provider's network. This skill finds such gaps by locating every site that builds, receives, or validates part of a delegated login flow, verifying each one in parallel, and merging the results into <output_dir>/oauth-results.md.

Code-review guidance below is split by role: the client application (the site offering the sign-in button) and the provider (the authorization server). Most codebases play one role; some play both, and the checks differ.

What it is NOT

• Local credential flows (/websec:authentication): password login, reset, lockout, and the local session. Test: if no third party issues the credential being trusted, it is the sibling skill.
• Token signature mechanics (/websec:jwt): whether an identity token's signature is checked, its algorithm pinned, its claims asserted. Judge that there and record the flow-level consequence here; do not re-derive the signature analysis.
• Generic request forgery (/websec:csrf): a missing form token on an ordinary state-changing endpoint. A missing or unchecked state on an authorization callback is judged here, because the fix and the impact are flow-specific.
• What the resulting identity may reach (/websec:access-control): once the grant is exchanged and a session or token exists, whether that principal may touch a given object or invoke a given function is authorization. Test: is the defect in how the grant is obtained or validated — callback matching, state, scope, code exchange — or in what the resulting identity is then allowed to reach? The first is here, the second is theirs.
• Outbound request reachability (/websec:ssrf): whether a provider's fetch of a registrant-supplied URI can reach internal services. The trust decision — accepting an unauthenticated registration or dereferencing a client-supplied request reference — is judged here; note the reachability question there.
• Open redirect as a class (/websec:open-redirect): a redirect helper that takes its destination from the request — including the post-login returnUrl — belongs there wherever it lives in the codebase. It is a gadget used to steal a code; the OAuth finding is the loose callback validation that lets the gadget be selected. Test: is the fix in the redirect helper's destination check (there) or in the redirect_uri matching at the authorization request and the code exchange (here)?
• Not a finding: a service that plays no part in the flow because architecture.md records the delegated login as completed elsewhere — a gateway, a dedicated sign-in service, or a front end for a back end that exchanges the code and forwards the result. The absence of state, callback matching, or an exchange here is the architecture, not a flaw; read the "Enforced where" column and the trust-boundary section before reporting one. What is judged in that case: what this service accepts from that hop — claims, a subject identifier, a session it did not issue — and whether anything confirms the hop produced it. Where the hop's configuration cannot be read, the label is NEEDS MANUAL REVIEW naming it.
• Not a finding: a callback matched byte-for-byte against a registered value; a session-bound state that is generated, stored, compared, and discarded; a consent screen (consent does not prevent theft); a published verification key (public keys are meant to be public); an identity token that is fully validated even though the flow also carries other parameters.