security-review-owasp-oauth2

Review OAuth 2 authorization code flows by inspecting PKCE usage, redirect URI validation, and state parameter checks across clients and authorization servers. Evidence-based assessment confirms code exchange handling aligns with OWASP guidance.

Prevent token replay attacks in OAuth 2 by evaluating access token, refresh token, and audience controls using evidence-based assessment. Review replay-resistance protections in token lifecycle handling against realistic abuse paths.

PKCE validation in OAuth 2 redirect handling is needed for authorization code flows to prevent interception attacks. Review PKCE implementation across clients and authorization servers to confirm proper code exchange and mix-up defenses.

This OAuth 2 review checks confidential-client authentication and flags legacy or unsafe grant usage such as implicit or password flows. Evidence-based assessment identifies forbidden legacy flows against OWASP OAuth 2 guidance.

Review token lifecycle protections and refresh token handling for OAuth 2 by evaluating access token, refresh token, and audience controls. Evidence-based assessment identifies realistic abuse paths and replay-resistance gaps.

OAuth 2 redirect URI validation fails during security review when redirect handling lacks strict matching across clients and authorization servers. Evidence-based assessment checks redirect URI checks, state validation, and mix-up defenses against OWASP guidance.