OAuth 2.0 Flow Attacks

Try it out loud first. Then check yourself:

1. Authorization code flow with PKCE is the recommended flow for all clients; implicit flow is deprecated
2. Missing state parameter enables login CSRF; loose redirect_uri matching leaks codes to attacker hosts
3. PKCE binds the code to a code_verifier so an intercepted authorization code cannot be redeemed
4. Mix-up and token substitution attacks: validate issuer and audience; use OIDC nonce for ID tokens
5. Store refresh tokens securely and use rotation with reuse detection for public clients

If the interviewer pushes back

• Why does PKCE matter for confidential clients too, not just mobile and SPA apps?

Go deeper

• datatracker.ietf.org/doc/html/rfc7636