skills.rest
Prohao42
Prohao42COMMUNITY
Explore all skills by this author →
GitHub

oauth-oidc-misconfiguration

Audits OAuth 2.0/OpenID Connect misconfigurations in redirect flows, nonce handling, PKCE enforcement, token binding, and provider trust.

120|8|Updated Jun 2, 2026
Search Tags:#oauth#misconfiguration#oidc#security-testing#pkce#nonce#redirect-uri
One-click install
npx skills add https://github.com/Prohao42/aimy-sikll --skill oauth-oidc-misconfiguration-prohao42
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-oidc-misconfiguration
Source: https://github.com/Prohao42/aimy-sikll/tree/main/ai-mian/hack-skills/skills/oauth-oidc-misconfiguration
Command: npx skills add https://github.com/Prohao42/aimy-sikll --skill oauth-oidc-misconfiguration-prohao42

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OAuth 2.0 and OpenID Connect misconfigurations can expose sensitive data, enable token leakage, or allow session hijacking. This playbook provides a focused checklist to audit redirect_uri handling, state and nonce validation, PKCE enforcement, token audience checks, and identity-provider trust decisions.

Core Features & Use Cases

  • Redirect URI validation checks, matching and open redirect prevention.
  • State/nonce binding verification, proper session linkage, and replay protection.
  • PKCE enforcement for public clients and code flow integrity across mobile, web, and SPA apps.
  • Token audience, issuer, and binding verification to prevent token misuse and cross-client access.
  • Identity-provider trust assessment across common IdPs (Google, GitHub, Microsoft, Okta) and custom providers; suitable for pentests and security reviews.

Quick Start

Load this playbook to begin a focused review of OAuth2/OIDC redirect flows, state/nonce handling, PKCE enforcement, token audience checks, and identity-provider trust.

Frequently Asked Questions about oauth-oidc-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth 2.0 redirect_uri validation and prevent open redirects?▼

To test OAuth 2.0 redirect_uri validation, audit redirect flows for strict matching and open redirect prevention. This verifies proper URI handling across social or enterprise identity providers to prevent token leakage and session hijacking.

What is the best way to verify PKCE enforcement and nonce validation in OIDC flows?▼

Verifying PKCE enforcement and nonce validation in OIDC flows requires checking code flow integrity for public clients and ensuring proper session linkage. This validates replay protection across mobile, web, and SPA apps.

How do I audit token audience and issuer checks across custom identity providers?▼

To audit token audience and issuer checks across custom identity providers, verify token binding to prevent cross-client access and misuse. This assesses trust decisions for providers like Google, GitHub, Microsoft, and Okta.

Does this OAuth misconfiguration checklist support security testing for enterprise IdPs like Okta?▼

Yes, this OAuth misconfiguration checklist supports security testing for enterprise IdPs like Okta. It assesses identity-provider trust decisions and validates state binding, nonce validation, and redirect_uri matching during pentests.

What common OAuth 2.0 misconfigurations expose sensitive data or enable session hijacking?▼

Common OAuth 2.0 misconfigurations that expose sensitive data or enable session hijacking include improper redirect_uri handling, weak state and nonce validation, missing PKCE enforcement, and inadequate token audience checks across identity providers.

Related Skills

Explore More Software Engineering Skills→
hirokazu-kobayashi-koba-hirohirokazu-kobayashi-koba-hiro
7

authorization-endpoint

Implement OAuth 2.0 authorization requests, consent flows, and code generation.

Community
Advanced
YlikenYliken
5

oauth-oidc-misconfiguration

Assess OAuth2/OpenID Connect misconfigurations across redirect_uri, state, PKCE, and token binding.

Community
Advanced
zebbernzebbern
4.5k

Burp Suite Web Application Testing

Automate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.

Community
Advanced
asdfgh1445asdfgh1445
735

Strix•JWT 身份认证测试

Detect JWT and OIDC signature validation, header manipulation, and key fetching flaws.

Community
Advanced