vulns.co
/
GKData.io MCP

Back to Checklists

Modern OAuth and OIDC

PKCE and DPoP only help if the token endpoint requires them. Read the metadata, then compare it with one login you complete yourself.

Tags: oauth, oidc, pkce, dpop

Checklist

  • Read metadata: Open the authorization-server or OpenID configuration. Note grant types, code challenge methods, DPoP algorithms, and whether PAR or JAR is advertised.
  • Client authentication: Public versus confidential. A public client with no PKCE, or a confidential client that issues a token with no client secret, is the note.
  • redirect_uri rules: Record the registered value and whether the match is exact. Only exercise a redirect target you control and the program allows.
  • PKCE enforcement: On a login you start, note whether S256 is required, whether plain is accepted, and whether a token is issued when the verifier is omitted.
  • DPoP binding: If a proof is sent, note htm, htu, and ath. Compare a normal call with a later call that omits the proof. Do not forge proofs.
  • state and nonce: The authorization response should bind to the browser that started the request. Missing state or nonce on that client is the result.
  • Issuer mix-up: When more than one issuer or tenant exists, confirm iss, aud, and the token endpoint belong to the party you started with.
  • Refresh and revoke: Compare requested scopes with granted scopes. Reuse a refresh token after rotation, logout, or consent removal and record whether it still works.