oauth-oidc-misconfiguration

To check OAuth 2.0 redirect URI validation, review callback endpoints for prefix/path confusion, open redirect chaining, and leftover localhost patterns to ensure callbacks are strictly bound to your client application.

PKCE enforcement requires using Proof Key for Code Exchange to prevent authorization code interception. You need PKCE enforcement for specific client types like SPAs and mobile apps during OAuth/OIDC authorize-to-callback-to-token-exchange flows.

To validate state and nonce parameters in OpenID Connect, verify that both values are cryptographically unpredictable and correctly bound to the user session, ensuring protection against CSRF and token replay attacks.

Yes, OAuth token audience validation prevents cross-client token reuse by ensuring the `aud` (audience) and `iss` (issuer) claims are strictly verified, stopping tokens from being accepted by unintended clients.

The best way to test OIDC misconfiguration risks is applying a targeted checklist during security reviews to verify redirect handling, state/nonce binding, PKCE enforcement, and token audience checks across SPA, mobile, and server-rendered clients.

Account rebinding happens in OAuth callback handling when token and identity binding checks are lax, allowing an authorization response to be improperly linked to a different user session or identity provider account.