SKILL.md
OAuth Security Anti-Pattern
Severity: High
Summary
OAuth 2.0/OIDC flows are complex and easily misconfigured. The critical mistake: failing to implement and validate the state parameter. This parameter defends against CSRF attacks during OAuth flows. Missing or predictable state allows attackers to trick victims into logging into the attacker's account, enabling account takeover.
The Anti-Pattern
The anti-pattern is initiating OAuth flows without state parameters, or using predictable values not validated on callback.
BAD Code Example
# VULNERABLE: The OAuth flow is initiated without a `state` parameter.
from flask import request, redirect
OAUTH_PROVIDER_URL = "https://provider.com/auth"
CLIENT_ID = "my-client-id"
CALLBACK_URL = "https://myapp.com/callback"
@app.route("/login/provider")
def oauth_login():
# Redirects user to OAuth provider.
# FLAW: No `state` parameter to prevent CSRF.
auth_url = (f"{OAUTH_PROVIDER_URL}?client_id={CLIENT_ID}"
f"&redirect_uri={CALLBACK_URL}&response_type=code")
return redirect(auth_url)
@app.route("/callback")
def oauth_callback():
# User redirected back from provider.
# No way to verify callback corresponds to user-initiated flow.
auth_code = request.args.get("code")
# Exchanges code for tokens, logs user in.
# Attacker can link victim's session to attacker's account.
access_token = exchange_code_for_token(auth_code)
log_user_in(access_token)
return "Logged in successfully!"Attack:
- Attacker initiates OAuth flow with own account
- Provider redirects to
https://myapp.com/callback?code=ATTACKER_CODE - Attacker intercepts and pauses request
- Attacker tricks victim into visiting malicious callback URL
myapp.comassociates victim's session with attacker's account
GOOD Code Example
# SECURE: A unique, unpredictable `state` is generated, stored in the session, and validated on callback.
from flask import request, redirect, session
import secrets
@app.route("/login/provider/secure")
def oauth_login_secure():
# 1. Generate cryptographically random `state`.
state = secrets.token_urlsafe(32)
# 2. Store in user's session.
session['oauth_state'] = state
auth_url = (f"{OAUTH_PROVIDER_URL}?client_id={CLIENT_ID}"
f"&redirect_uri={CALLBACK_URL}&response_type=code"
f"&state={state}") # 3. Send state to provider.
return redirect(auth_url)
@app.route("/callback/secure")
def oauth_callback_secure():
# 4. Provider returns `state` in callback.
received_state = request.args.get("state")
auth_code = request.args.get("code")
# 5. CRITICAL: Validate returned state matches session state.
stored_state = session.pop('oauth_state', None)
if stored_state is None or not secrets.compare_digest(stored_state, received_state):
return "Invalid state parameter. CSRF attack detected.", 403
# State valid, safe to proceed.
access_token = exchange_code_for_token(auth_code)
log_user_in(access_token)
return "Logged in successfully!"Detection
- Trace the OAuth flow: Start at the point where your application redirects to the OAuth provider.
- Is a state parameter being generated? - Is it cryptographically random and unpredictable?
- Examine the callback endpoint:
- Does it retrieve the state from the incoming request? - Does it compare it to a value stored in the user's session before the redirect? - Is the comparison done in constant time (hmac.compare_digest) to prevent timing attacks? - Is the state value single-use (i.e., deleted from the session after being checked)?
Prevention
- Always use
stateparameter: Required in all OAuth/OIDC authorization requests. - Generate cryptographically random
state: Minimum 32 characters. Never use predictable values (user ID, timestamp). - Bind to session: Store
statein session cookie before redirect. - Strictly validate on callback: Compare request
statewith session value. Reject mismatches. - Make single-use: Remove from session after validation to prevent replay attacks.
- Use PKCE for public clients: SPAs and mobile apps require PKCE (Proof Key for Code Exchange) in addition to
state.
Related Security Patterns & Anti-Patterns
- [Session Fixation Anti-Pattern](../session-fixation/): A successful OAuth CSRF attack is a form of session fixation.
- [Insufficient Randomness Anti-Pattern](../insufficient-randomness/): The
stateparameter must be generated with a cryptographically secure random number generator. - [Missing Authentication Anti-Pattern](../missing-authentication/): OAuth is a form of authentication, and its flows must be implemented correctly to be secure.