oauth-security-anti-pattern

Detect missing state parameters and insecure redirects in OAuth 2.0 and OIDC flows.

8|1|Updated Jan 19, 2026

Search Tags:#security #authentication #vulnerability #oauth #oidc #csrf

Ready to run

npx skills add https://github.com/igbuend/grimbard --skill oauth-security-anti-pattern

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oauth-security-anti-pattern
Source: https://github.com/igbuend/grimbard/tree/main/skills/oauth-security-anti-pattern
Command: npx skills add https://github.com/igbuend/grimbard --skill oauth-security-anti-pattern

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in OAuth and OIDC implementations, specifically focusing on preventing Cross-Site Request Forgery (CSRF) attacks that can lead to account takeover.

Core Features & Use Cases

CSRF Protection: Detects and helps implement the use of unpredictable state parameters in OAuth flows.
Secure Redirect Handling: Ensures that callbacks from OAuth providers are validated against the original request.
Use Case: Reviewing an application's login process that uses Google Sign-In to ensure the state parameter is correctly generated, stored, and validated to prevent attackers from hijacking user sessions.

Quick Start

Review the current OAuth implementation for security vulnerabilities related to the state parameter.

Frequently Asked Questions about oauth-security-anti-pattern

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent CSRF attacks in my OAuth 2.0 authentication flow?▼

Prevent CSRF attacks in OAuth 2.0 flows by generating an unpredictable `state` parameter, storing it securely, and validating it against the original request during the callback to ensure session integrity.

Why does my OIDC login process need a state parameter with third-party identity providers?▼

Your OIDC login process needs a `state` parameter to prevent Cross-Site Request Forgery (CSRF) attacks that can lead to account takeover by validating that the callback originated from your original authentication request.

How do I validate OAuth callback integrity to prevent insecure redirect handling?▼

Validate OAuth callback integrity by ensuring the callback from the OAuth provider is matched against the original request, specifically verifying that the `state` parameter is neither missing nor predictable.

What are common OAuth implementation vulnerabilities related to account takeover?▼

Common OAuth implementation vulnerabilities include missing or predictable `state` parameters and insecure redirect handling, which expose authentication flows to CSRF attacks and potential account takeover.

Can I use this to review Google Sign-In for missing state parameter validation?▼

Yes, you can review an application's Google Sign-In process to ensure the `state` parameter is correctly generated, stored, and validated to prevent attackers from hijacking user sessions.