Modern OAuth and OIDC
PKCE and DPoP only help if the token endpoint requires them. Read the metadata, then compare it with one login you complete yourself.
Tags: oauth, oidc, pkce, dpop
Checklist
- Read metadata: Open the authorization-server or OpenID configuration. Note grant types, code challenge methods, DPoP algorithms, and whether PAR or JAR is advertised.
- Client authentication: Public versus confidential. A public client with no PKCE, or a confidential client that issues a token with no client secret, is the note.
- redirect_uri rules: Record the registered value and whether the match is exact. Only exercise a redirect target you control and the program allows.
- PKCE enforcement: On a login you start, note whether S256 is required, whether plain is accepted, and whether a token is issued when the verifier is omitted.
- DPoP binding: If a proof is sent, note htm, htu, and ath. Compare a normal call with a later call that omits the proof. Do not forge proofs.
- state and nonce: The authorization response should bind to the browser that started the request. Missing state or nonce on that client is the result.
- Issuer mix-up: When more than one issuer or tenant exists, confirm iss, aud, and the token endpoint belong to the party you started with.
- Refresh and revoke: Compare requested scopes with granted scopes. Reuse a refresh token after rotation, logout, or consent removal and record whether it still works.