OAuth and OIDC

Skill: OAuth, DPoP, and mix-up

Ask: Is the authorization code bound to this client, and can the token be replayed without the proof the server claimed to require?

Stop: You have the authorization response fields you observed, including whether iss is checked, and you have not reused a code.

Open the skill

Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.

Checklists

• Modern OAuth and OIDC - PKCE and DPoP only help if the token endpoint requires them. Read the metadata, then compare it with one login you complete yourself.

Disclosures

• An OAuth redirect left the registered callback - OAuth redirect validation

Playbooks

• OAuth PKCE, DPoP, and mix-up - Modern OAuth fails when the token endpoint does not require what the metadata advertises. PKCE (RFC 7636) and DPoP (RFC 9449) only help if a token is refused without the proof. Mix-up is a client that sends a code to the wrong token endpoint.
• OAuth & SSO Misconfiguration - Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.

Tools

• Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.

Payloads

• OAuth / OIDC - redirect_uri tricks, implicit flow, mixed response_type, state CSRF. Pair with the OAuth playbook.

Bypasses

• OAuth redirect_uri / flow tricks - Allowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin.

Questions

Is an open redirect on the IdP enough?

It is a gadget. It becomes ATO when the authorization code or token lands on an origin you control.

What about state?

Missing or predictable state is login CSRF on SSO. Pair it with a redirect_uri issue before you call it ATO.

This page is the linked pack hunt_brief("oauth") returns on the MCP connector. Authorized testing only.