Security Best Practices

OAuth is secure when implemented correctly. But small mistakes can lead to serious vulnerabilities. Let's learn from real-world security issues.

Common OAuth Vulnerabilities

1. CSRF Protection: The State Parameter

Without the state parameter, an attacker can trick you into linking their account.

The Attack

1. Attacker starts OAuth flow on your app
2. Gets authorization URL: yourapp.com/callback?code=ATTACKER_CODE
3. Tricks victim into clicking this URL
4. Victim's account is now linked to attacker's Google account
5. Attacker can now "Sign in with Google" to victim's account

The Defense

// ALWAYS use a state parameter
app.get('/login', (req, res) => {
  // Generate cryptographically random state
  const state = crypto.randomBytes(32).toString('hex');

  // Store in session (or signed cookie)
  req.session.oauthState = state;

  const authUrl = new URL('https://accounts.google.com/o/oauth2/v2/auth');
  authUrl.searchParams.set('state', state);
  // ... other params

  res.redirect(authUrl.toString());
});

app.get('/callback', (req, res) => {
  const { code, state } = req.query;

  // CRITICAL: Verify state before processing
  if (!state || state !== req.session.oauthState) {
    return res.status(403).json({ error: 'Invalid state parameter' });
  }

  // Clear state to prevent reuse
  delete req.session.oauthState;

  // Now safe to exchange code for tokens
  // ...
});

2. Redirect URI Validation

The redirect_uri is where tokens are sent. If an attacker can control it, they steal tokens.

The Attack: Open Redirect

Legitimate: https://yourapp.com/callback
Malicious:  https://yourapp.com/callback/../../../attacker.com

// Or via subdomain:
Malicious:  https://evil.yourapp.com/callback

The Defense

// Server-side: Strict redirect URI validation
const ALLOWED_REDIRECT_URIS = [
  'https://yourapp.com/callback',
  'https://yourapp.com/oauth/callback'
];

function validateRedirectUri(uri) {
  // Exact match only - no pattern matching
  return ALLOWED_REDIRECT_URIS.includes(uri);
}

// Register exact URIs with the OAuth provider
// Never use wildcards like https://yourapp.com/*

3. Token Storage

Where you store tokens matters. A lot.

Secure Cookie Configuration

// Setting tokens in httpOnly cookies
app.get('/callback', async (req, res) => {
  const tokens = await exchangeCodeForTokens(req.query.code);

  // Access token in httpOnly cookie
  res.cookie('access_token', tokens.access_token, {
    httpOnly: true,     // Not accessible via JavaScript
    secure: true,       // HTTPS only
    sameSite: 'lax',    // CSRF protection
    maxAge: 3600000,    // 1 hour
    path: '/'
  });

  // Refresh token - even more restricted
  res.cookie('refresh_token', tokens.refresh_token, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict', // Only sent on same-site requests
    maxAge: 30 * 24 * 3600000, // 30 days
    path: '/api/auth'   // Only sent to auth endpoints
  });

  res.redirect('/dashboard');
});

4. Why Implicit Flow Was Deprecated

The Implicit flow returned tokens directly in the URL fragment:

https://yourapp.com/callback#access_token=abc123&token_type=bearer

Problems with Implicit Flow

The Solution: Auth Code + PKCE

// Instead of Implicit, use Authorization Code with PKCE
// Tokens are exchanged server-side, never in URLs

5. Token Lifetime Best Practices

6. Refresh Token Rotation

Rotating refresh tokens limits the damage of token theft:

// When refreshing, issue a new refresh token
app.post('/api/auth/refresh', async (req, res) => {
  const { refresh_token } = req.cookies;

  // Verify and invalidate old refresh token
  const tokenData = await verifyAndRevokeRefreshToken(refresh_token);

  if (!tokenData) {
    // Token reuse detected - possible theft!
    await revokeAllUserTokens(tokenData.userId);
    return res.status(401).json({ error: 'Session invalidated' });
  }

  // Issue new tokens
  const newAccessToken = generateAccessToken(tokenData.userId);
  const newRefreshToken = generateRefreshToken(tokenData.userId);

  res.cookie('refresh_token', newRefreshToken, { /* secure options */ });
  res.json({ access_token: newAccessToken });
});

7. Real-World Security Incidents

GitHub OAuth Attack (2022)

Slack CSRF Vulnerability (2016)

Security Checklist

Key Takeaways

Next up: OAuth Assessment - Test your knowledge with real-world scenarios.