skills.rest
igbuend
igbuendCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oauth-security-anti-pattern

Detect missing state parameters and insecure redirects in OAuth 2.0 and OIDC flows.

8|1|Updated Jan 19, 2026
Search Tags:#security#authentication#vulnerability#oauth#oidc#csrf
One-click install
npx skills add https://github.com/igbuend/grimbard --skill oauth-security-anti-pattern
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-security-anti-pattern
Source: https://github.com/igbuend/grimbard/tree/main/skills/oauth-security-anti-pattern
Command: npx skills add https://github.com/igbuend/grimbard --skill oauth-security-anti-pattern

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in OAuth and OIDC implementations, specifically focusing on preventing Cross-Site Request Forgery (CSRF) attacks that can lead to account takeover.

Core Features & Use Cases

  • CSRF Protection: Detects and helps implement the use of unpredictable state parameters in OAuth flows.
  • Secure Redirect Handling: Ensures that callbacks from OAuth providers are validated against the original request.
  • Use Case: Reviewing an application's login process that uses Google Sign-In to ensure the state parameter is correctly generated, stored, and validated to prevent attackers from hijacking user sessions.

Quick Start

Review the current OAuth implementation for security vulnerabilities related to the state parameter.

Frequently Asked Questions about oauth-security-anti-pattern

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent CSRF attacks in my OAuth 2.0 authentication flow?▼

Prevent CSRF attacks in OAuth 2.0 flows by generating an unpredictable `state` parameter, storing it securely, and validating it against the original request during the callback to ensure session integrity.

Why does my OIDC login process need a state parameter with third-party identity providers?▼

Your OIDC login process needs a `state` parameter to prevent Cross-Site Request Forgery (CSRF) attacks that can lead to account takeover by validating that the callback originated from your original authentication request.

How do I validate OAuth callback integrity to prevent insecure redirect handling?▼

Validate OAuth callback integrity by ensuring the callback from the OAuth provider is matched against the original request, specifically verifying that the `state` parameter is neither missing nor predictable.

What are common OAuth implementation vulnerabilities related to account takeover?▼

Common OAuth implementation vulnerabilities include missing or predictable `state` parameters and insecure redirect handling, which expose authentication flows to CSRF attacks and potential account takeover.

Can I use this to review Google Sign-In for missing state parameter validation?▼

Yes, you can review an application's Google Sign-In process to ensure the `state` parameter is correctly generated, stored, and validated to prevent attackers from hijacking user sessions.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfigurations in login flows.

Community
Intermediate
evolv3aievolv3ai
3

MCP OAuth Cloudflare

Implement OAuth 2.0 authentication for MCP servers on Cloudflare Workers.

Community
Advanced
telum-aitelum-ai
2

oauth-implementation

Implement OAuth 2.0 and OpenID Connect authentication with PKCE and JWT validation.

Official
Advanced
aws-samplesaws-samples
1

ipa-stack-cognito

Deploy an AWS Cognito User Pool with OAuth 2.0 Hosted UI endpoints.

Official
Intermediate