oauth-oidc-misconfiguration

To test OAuth redirect URI validation, you check for prefix/path confusion, localhost leftovers, and improper redirect binding. This identifies unsafe redirect handling and authorization bypass risks in your callback flow.

The state parameter in an OIDC login flow prevents CSRF-like authorization failures by ensuring the callback is tied to the user's original session. It must be unpredictable and correctly bound to be effective.

To audit PKCE enforcement for OAuth public clients, you verify that a code_challenge is present and that the authorization server correctly checks the verifier. This prevents authorization code interception.

Yes, you can check for token reuse by verifying token claims for the correct issuer and audience. This ensures tokens are not accepted across different clients, preventing cross-client token misuse.

OIDC callback account binding weaknesses connect attacker identities to victim sessions due to callback/account rebinding mistakes and overly broad scopes. Assessing scope and account linkage fixes this vulnerability.

Yes, this OAuth audit applies to authorization-code and OIDC login flows across web, SPA, and mobile clients. It validates redirect URIs, state, nonce, PKCE, and token claims for all these environments.