oauth-oidc-misconfiguration

A focused checklist for finding misconfigurations in OAuth 2.0 and OpenID Connect implementations. It targets the parts of the flow attackers most often abuse: redirect_uri validation (prefix matching, open-redirect chaining, path confusion, leftover localhost entries), state handling (missing, static, predictable, or not bound to a session), PKCE enforcement for public clients, OIDC nonce validation on returned ID tokens, token audience and issuer checks, cross-client token reuse, account-binding mistakes, and over-broad scope grants.

Load it when the target integrates identity providers such as Google, GitHub, Microsoft, or Okta, or when you observe parameters like authorize, callback, redirect_uri, code, state, nonce, or code_challenge, including mobile and SPA clients that may validate more weakly than the web flow. A quick-triage procedure maps the full flow (authorize, callback, token exchange, logout), replays callbacks with altered state, nonce, and redirect_uri, compares client types to find the weakest validation, and checks whether one provider account can be rebound to another local account.

The skill is a scoped checklist rather than an exhaustive cryptographic guide: for JWT header abuse and token-signature attacks it points to a companion jwt-oauth-token-attacks skill, and it cross-references related routes for CORS/cross-origin token exposure, SAML and enterprise SSO assertion attacks, and CSRF-driven login or binding bugs. It is best used during a web or API assessment to prioritize the highest-value authentication and authorization tests before diving into deeper token cryptanalysis.