security-auth-flow-review

To audit an OAuth2 or OIDC authentication flow, you reconstruct the end-to-end process from client to logout, threat-map each step, and produce an auth-review.md containing findings, severities, and remediation guidance.

Threat mapping for an authentication flow involves analyzing each step from IdP callback to session refresh to identify threat vectors, assign severities, and propose concrete security fixes with designated owners.

Perform a security review of a SAML and session handling flow by evaluating the proposed design end-to-end, identifying weaknesses in session management, and documenting actionable remediation steps in a review document.

Yes, you can use this auth flow audit for both web and mobile apps, as it evaluates existing or proposed authentication flows across OAuth2, OIDC, SAML, and session handling end-to-end.

The best way to document auth flow findings is to generate an auth-review.md containing a step-by-step flow reconstruction, a detailed threat map, and remediation guidance with assigned owners and severities.