oauth-oidc-misconfiguration

To check OAuth2 redirect_uri validation, you must verify exact string matching against pre-registered URIs to prevent open redirects and mismatches. This assessment covers authorize and callback flows to ensure callback integrity.

Validating PKCE enforcement requires verifying the secure handling of the code_verifier and code_challenge parameters across the OAuth2 flow. You must explicitly check that the code_challenge is correctly bound and validated during the token exchange process.

Correct state and nonce handling in OIDC ensures user session integrity by binding the nonce to the authentication flow. You must explicitly verify that these parameters are correctly generated, sent, and validated upon callback to thwart impersonation attacks.

You can audit OIDC token binding and audience validation across web, mobile, and SPA clients. The assessment requires explicit checks for correct issuer and audience validation to prevent token reuse across different clients.

Common OAuth2 misconfigurations include missing PKCE enforcement, improper state/nonce handling, weak token binding, and incorrect audience validation. Detecting these issues requires a focused checklist examining authorize and token exchange flows for correct parameter validation.

OAuth2 misconfiguration testing works for web, mobile, and SPA clients leveraging OAuth/OIDC. The assessment applies explicit security checks across authorize, token exchange, and callback flows to identify vulnerabilities specific to each client type.