skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfigurations in login flows.

5|2|Updated May 16, 2026
Search Tags:#oauth#oidc#state#pkce#token validation#nonce#redirect_uri
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill oauth-oidc-misconfiguration-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-oidc-misconfiguration
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/oauth-oidc-misconfiguration
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill oauth-oidc-misconfiguration-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OAuth and OIDC misconfigurations can silently enable account takeovers, token leakage, and session binding failures, often caused by weak handling of redirect URIs, state/nonce, PKCE, token validation, scopes, and identity binding.

Core Features & Use Cases

  • Redirect URI and callback validation checks: Validate redirect URI allowlists, detect prefix/path confusion, and look for localhost leftovers and open-redirect chaining.
  • Flow integrity enforcement: Verify state and nonce generation plus validation, ensure PKCE is enforced for public clients, and confirm correct callback binding.
  • Token acceptance correctness: Check issuer/audience validation and prevent cross-client token reuse while ensuring scopes are not over-granted.

Quick Start

Use the oauth-oidc-misconfiguration skill to review an OAuth/OIDC login flow end-to-end and identify which of state, nonce, redirect URI validation, PKCE, and token audience/issuer checks are weak for a given client and IdP.

Frequently Asked Questions about oauth-oidc-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check OAuth redirect URI validation for security weaknesses?▼

To check OAuth redirect URI validation, review allowlists for prefix or path confusion, detect localhost leftovers, and look for open-redirect chaining vulnerabilities in your authorization-code callback flow.

What OAuth OIDC misconfigurations enable account takeover?▼

OAuth and OIDC misconfigurations enabling account takeover include weak redirect URI validation, improper state and nonce handling, missing PKCE enforcement for public clients, and incorrect token audience or issuer validation.

How do I review OIDC token validation for issuer and audience correctness?▼

Review OIDC token validation by checking issuer and audience constraints, preventing cross-client token reuse, and ensuring scopes are not over-granted to stop token leakage and session binding failures.

When do I need PKCE enforcement in OAuth login flows?▼

PKCE enforcement is needed for public clients in OAuth login flows, such as SPA and mobile applications, to verify flow integrity and ensure correct callback binding during authorization-code requests.

What are the limitations of state and nonce handling in OIDC implementations?▼

Limitations in state and nonce handling occur when generation and validation are missing or incorrect, failing to bind the authorization request and ID token properly, which silently enables session binding failures.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

testing-oauth2-implementation-flaws

Assess OAuth 2.0 and OpenID Connect implementations for security flaws.

Official
Advanced
ok-helloworldok-helloworld
241

oauth-oidc-misconfiguration

Detect OAuth 2.0 and OpenID Connect misconfigurations in login flows.

Community
Intermediate
lNwNllNwNl
2

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfiguration risks in authorization flows.

Community
Intermediate
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced