Where this cannot be avoided, authorization servers MUST provide other means for the resource server to distinguish between the two types of access tokens.¶ This attack potentially affects not only implementations using RFC9068, but also similar, bespoke solutions.¶ If the resource server cannot properly distinguish between access tokens obtained with involvement of the resource owner and those without, the client may accidentally be able to access resources belonging to the resource owner.¶ For example, if a client is able to choose its own client_id during registration with the authorization server, a malicious client may set it to a value identifying a resource owner (e.g., a sub value if OpenID Connect is used). If both options are possible, a resource server may mistake a client’s identity for the identity of a resource owner. In cases of access tokens obtained through grants where no resource owner is involved, such as the client credentials grant, the value of “sub” SHOULD correspond to an identifier the authorization server uses to indicate the client application.¶
Refresh tokens are an attractive target for attackers because they represent the full scope of access granted to a certain client, and they are not further constrained to a specific resource. They also add to the security of OAuth, since they allow the authorization server to issue access tokens with a short lifetime and reduced scope, thus reducing the potential impact of access token leakage.¶ For example, it is standard practice of reverse proxies to accept X-Forwarded-For headers and just add the origin of the inbound https://elitecolumbia.com/innovative-software-solutions-that-help-toronto-businesses-from-convert-edge.html request (making it a list). While the headers are often custom, application-specific headers, standardized header fields for client certificates and client certificate chains are defined in RFC9440.¶ (In practice, however, most user agents will only show this behavior for 307 redirects.)¶ For all other status codes, including the popular 302, user agents can opt not to rewrite POST to GET requests, thereby causing the user’s credentials to be revealed to the client.
An attacker might declare an uncompromised authorization server’s authorization endpoint URL as “their” authorization server URL, https://repairdesign24.com/decor/how-to-get-rid-of-mold-that-appeared-on-wooden.html but declare a token endpoint under their own control.¶ For both defenses, clients MUST store, for each authorization request, the issuer they sent the authorization request to and bind this information to the user agent. As soon as the browser navigates to the attacker’s page or loads the third-party content, the attacker receives the authorization response URL and can extract code or state (and potentially access_token).¶
Note
Copyright (c) 2025 IETF Trust and the persons identified as the document authors. OAuth is limited in granularity to the coarse functionality (the scopes) exposed by the target service. OAuth can be used in conjunction with XACML, where OAuth is used for ownership consent and access delegation whereas XACML is used to define the authorization policies (e.g., managers can view documents in their region).
OAuth 2.0 Security Best Current Practice
If an external OAuth service is used, you should be able to identify the specific provider from the hostname to which the authorization request is sent. Doing some basic recon of the OAuth service being used can point you in the right direction when it comes to identifying vulnerabilities. Although there are a handful of mandatory components required for the basic functionality of each grant type, the vast majority of the implementation is completely optional. OAuth authentication vulnerabilities arise partly because the OAuth specification is relatively vague and flexible by design.
- OAuth is also unrelated to XACML, which is an authorization policy standard.
- It replaced OAuth 1.0 in 2012 and is now the de facto industry standard for online authorization.
- If an automatic approval of the authorization is enabled (which is not recommended for public clients according to RFC6749), the attack can be performed even without user interaction.¶
- In any OAuth flow, the user must approve the requested access based on the scope defined in the authorization request.
- PKCE provides robust protection against CSRF attacks even in the presence of an attacker that can read the authorization response (see Attacker (A3) in Section 3).
Clients MUST check that the authorization response was received from the correct issuer by comparing the distinct redirection URI for the issuer to the URI where the authorization response was received on. When receiving the authorization response, the client MUST compare the received issuer identifier to the stored issuer identifier. This defense requires that the authorization server sends its issuer identifier in the authorization response to the client. It is important to note that just storing the authorization server URL is not sufficient to identify mix-up attacks. In scenarios where an OAuth client interacts with two or more authorization servers, however, clients MUST prevent mix-up attacks. Mix-up attacks can occur in scenarios where an OAuth client interacts with two or more authorization servers and at least one authorization server is under the control of the attacker.
- Due to the dangers introduced by sending access tokens via the browser, the implicit grant type is mainly recommended for single-page applications.
- It is important to note that redirection URI validation vulnerabilities can also exist if the authorization server handles wildcards properly.
- It should be noted that audience restrictions — or, generally speaking, an indication by the client to the authorization server where it wants to use the access token — have additional benefits beyond the scope of token leakage prevention.
- Mix-up attacks can occur in scenarios where an OAuth client interacts with two or more authorization servers and at least one authorization server is under the control of the attacker.
- Authorization servers MUST determine, based on a risk assessment, whether to issue refresh tokens to a certain client.
Obviously, the check-in step (Step 5) will fail if the code was issued to another client ID, e.g., a client set up by the attacker. Except in these special cases, authorization code injection is usually not interesting when the code is created for a public client, as sending the code to the token endpoint is a simpler and more powerful attack, as described above.¶ In the case that the authorization code was created for a public client, the attacker can send the authorization code to the token endpoint of the authorization server and thereby get an access token. An attacker who has gained access to an authorization code contained in an authorization response (see Attacker (A3) in Section 3) can try to redeem the authorization code for an access token or otherwise make use of the authorization code.¶
How do OAuth authentication vulnerabilities arise?
OAuth authorization servers regularly redirect users to other websites (the clients), but they must do so safely.¶ Moreover, given the ratio of clients to authorization and resource servers, it is considered the more viable approach to move as much as possible security-related logic to those servers. Results of OAuth-related security research (see, for example, research.ubc and research.cmu) indicate a large portion of client implementations do not or fail to properly implement security controls, like state checks. Using mutual TLS for OAuth 2.0 RFC8705, on the other hand, allows a client to use the access token at multiple resource servers.¶ Still, since every access token is bound to a specific resource server, the client also needs to obtain a single resource server-specific access token when accessing several resource servers. The mechanism in RFC8707 can be used for this or the information can be encoded in the scope value (Section 3.3 of RFC6749).¶
For this reason, authorization servers SHOULD allow administrators to configure allowed origins for particular clients and/or for clients to register these dynamically.¶ This prevents framing by unauthorized origins in user agents that support CSP. To be effective, CSP must be used on the authorization endpoint and, if applicable, other endpoints used to authenticate the user and authorize the client (e.g., the device authorization endpoint, login https://angliannews.com/unique-software-solutions-for-business-from-the-experts-at-convert-edge.html pages, error pages, etc.). In addition to those, authorization servers SHOULD also use Content Security Policy (CSP) level 2 W3C.CSP-2 or greater.¶