skills.rest
jtdowney
jtdowneyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oauth-reviewer

Review OAuth 2.0 and OpenID Connect implementations against RFC 9700 security best practices.

Updated Jan 21, 2019
Search Tags:#code review#authorization#security#authentication#oauth#rfc9700
One-click install
npx skills add https://github.com/jtdowney/dotfiles --skill oauth-reviewer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-reviewer
Source: https://github.com/jtdowney/dotfiles/tree/main/dot_codex/skills/oauth-reviewer
Command: npx skills add https://github.com/jtdowney/dotfiles --skill oauth-reviewer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and scripts (resource) components.

What problem does it solve?

This Skill helps developers and security professionals identify and remediate security vulnerabilities in OAuth 2.0 and OpenID Connect implementations by auditing them against the latest security best practices.

Core Features & Use Cases

  • RFC 9700 Compliance Check: Reviews OAuth flows, token handling, and client configurations against OAuth 2.0 Security Best Current Practice (RFC 9700).
  • Vulnerability Identification: Detects common attack patterns like authorization code interception, PKCE bypass, and redirect URI manipulation.
  • Use Case: When reviewing a new OAuth client integration, use this Skill to ensure it correctly implements PKCE, handles refresh tokens securely, and avoids common pitfalls that could lead to security breaches.

Quick Start

Use the oauth-reviewer skill to review the security of our OAuth client implementation.

Frequently Asked Questions about oauth-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review my OAuth 2.0 implementation for security vulnerabilities?▼

An OAuth 2.0 security review checks authorization flows, token handling, PKCE usage, and redirect URI validation against RFC 9700 best practices to detect CSRF, code interception, and token leakage vulnerabilities.

What is RFC 9700 compliance for OAuth and OpenID Connect?▼

RFC 9700 compliance means OAuth 2.0 and OpenID Connect implementations follow security best practices for PKCE, refresh token handling, and client authentication to prevent authorization code interception and redirect URI manipulation attacks.

How do I check if my OAuth client is vulnerable to code interception?▼

Detect code interception by auditing PKCE usage and authorization flow configurations to ensure the OAuth client prevents authorization code interception, PKCE bypass, and redirect URI manipulation attacks.

Does this OAuth security audit cover OpenID Connect configurations?▼

Yes, the security audit reviews OpenID Connect implementations by analyzing token handling, client authentication mechanisms, and authorization flows alongside OAuth 2.0 configurations against RFC 9700 best practices.

What are common OAuth 2.0 security pitfalls when integrating a new client?▼

Common OAuth 2.0 pitfalls include incorrect PKCE implementation, insecure refresh token handling, and improper redirect URI validation, which can expose the client to CSRF, token leakage, and authorization code interception attacks.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

oauth-oidc-misconfiguration

Validate OAuth and OpenID Connect configurations for security misconfigurations.

Community
Intermediate
kalpmodikalpmodi
18

oauth-attacks

Test OAuth 2.0 and OIDC implementations for authorization code interception and misconfigurations.

Community
Advanced
seb1nseb1n
147

static-application-security-testing

Run SAST scans with Semgrep and CodeQL to detect vulnerabilities in source code.

Community
Advanced
brabos-aibrabos-ai
8

add-security-audit

Audit codebases against OWASP Top 10 vulnerabilities.

Official
Advanced