Course 2 - API Security Offence and Defense | Episode 3: OAuth Protocol: Standards, Authorization Flows, Attacks, and Real-World Case Study

In this lesson, you’ll learn about:OAuth — purpose & distinction: an authorization protocol that grants third-party apps scoped access to user resources without sharing user credentials; it’s about authorization, not authentication.OAuth 1.0a — core concepts & flows:Concepts: Consumer Key/Secret, Nonce, Signed requests (HMAC‑SHA1).Flows: one‑legged (trusted apps), two‑legged (token exchange), and three‑legged (adds user approval and a verifier; e.g., Twitter sign‑in).OAuth 2.0 — concepts & common flows:Concepts: Client ID/Secret, Scope (permissions), Response Type, State (CSRF defense).Flows: two‑legged (machine‑to‑machine) and three‑legged Authorization Code Grant (most common; auth code exchanged for access token after user consent).Primary attacker goal: steal an access token — the token’s scope defines the attacker’s effective privileges.Common OAuth vulnerabilities & attacks:Auth code leakage via redirect_uri: weak redirect validation lets codes be sent to attacker servers.CSRF in the OAuth flow: missing/invalid state allows attacker-forced authorization flows (account linking, CSRF).Open redirect: poor redirect checks enable phishing or token exfiltration vectors.CSRF via XSS / iframe chaining: use XSS to inject frames or scripts that bypass protections and extract codes/tokens.Implicit flow abuse: switching response_type=token causes tokens to be returned in URL fragments — easily exfiltrated by XSS.Hardening & best practices:Always use HTTPS to prevent MITM.Require and validate the state parameter to stop CSRF.Disable implicit flow unless strictly necessary; prefer Authorization Code with PKCE for public clients.Strictly validate redirect_uri (exact-match, not prefix).Sanitize and remove XSS vulnerabilities that could be chained into OAuth attacks.Minimize token lifetime and use scopes with least privilege.Real-world lessons: small, low-severity bugs can be chained (redirect issues, missing validation, XSS) to fully compromise accounts — careful end‑to‑end validation and layered defenses are essential.You can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy