#10 The Postman Always Rings Twice

The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code.

#9 Match Point

...if the "redirect_uri" parameter was included in the initial authorization request as described in Section 4.1.1, and if included ensure that their values are identical.

#8 Open redirect in rfc6749

OAuth Authorization Server and follow verbatim the OAuth core spec you might end up having an

#7 Native apps - Which OAuth flow ?

It is NOT recommended that native applications use the implicit flow.

recommended that native applications use the implicit flow. Native clients CAN NOT protect a client_secret unless it is configured at runtime as in the dynamic registration case (RFC 7591).

#6 Cross-site request forgery for OAuth Clients

#5 Cross-site request forgery for Authorization Servers

#4 On Bearer Tokens

GET /resource?access_token=mF_9.B5f-4.1Jq HTTP/1.1

Host: server.example.com

The access token ends up being logged in access.log files (being the access token part of the URI) - http://thehackernews.com/2013/10/vulnerability-in-facebook-app-allows.html

People tend to be indiscriminate on what copy and past in public forum when searching for answer (e.g. Stackoverflow).

There is a risk of access token leakage through the referrer - http://intothesymmetry.blogspot.it/2015/10/on-oauth-token-hijacks-for-fun-and.html

#3 The Devil Wears Prada

#2 Lassie Come Home for OAuth clients

If you are building an OAuth client,

Thou shall register a redirect_uri as much as specific as you can

#1 Lassie Come Home for Authorization Server

<snip>

//SHAMELESS SELF ADVERTISEMENT

like OAuth 2.0 and/or you want to know more about it If youOAuth 2.0 and/or you want to know more about it here you can find a book on OAuth that Justin Richer and myself have been writing on the subject.

</snip>

Some time ago I posted a blogpost abut Top 5 OAuth 2 Implementation Vulnerabilities This week I have extended the list while presenting Top X OAuth 2 Hacks at OWASP Switzerland.This blog post (like the presentation) is just a collection of interesting attack OAuth related.I have introduced this 'attack' in last year post . This is for, it is not extremely severe but, hey, is better to follow the spec. SpecificallyIt turned out that evenand did it wrong ... :)To all OAuth Providers be sure to follow section 4.1.3 of the spec in particularShould you fail to do it, this in combination with Lassie Come Home below is game over (even for implementer that support only the Authorization Code Grant flow ).If you want to implentIn a nutshellIf you do not follow this suggestions then you risk this Defined the the Most Common OAuth2 Vulnerability . So do you the state anti CSRF parameter, as long as you use the right library to check and not a broken one :)As per any other website part is important to not forget Cross Site Request Forgery aka CSRF protection in your OAuth provider impelemtation. Some examples are:(if you can avoid) pass the access_token as a URI parameter a lasince:If you are anthat use OAuth for authentication (). If you absolutely have to, you'd better read User Authentication with OAuth 2.0 . Specially if you are using the OAuth Implicit Grant flow (aka Client side).More about the topic in here and here ....and the winner is (again)Well this is hell of a danger.There are way too many example of provider vulnerable to this attack. Just listing few here:At least the mitigation for this issue is damn simple:BTW the slides are here