Hacking OAuth Pitfalls and Remedies
summary
Shows that the implicit flow detector browser extension can grab access tokens from SPAs and that leaked tokens let anyone call Google APIs to retrieve email, full name and even gender, proving real data exposure. Demonstrates an authorization code injection using a malicious “pretty kitty” browser extension plus a Spring Boot attack server to trick a legitimate app into exchanging a stolen code. Emphasizes the one‑time code window (30 seconds) and presents the working mitigation: PKCE implemented by a pixie CLI (Node.js) that exchanges a code verifier for tokens, preventing these attacks.
AI-written summary · about
chapters (7)
- 0:00Introduction and OAuth overview
- 7:07Implicit flow problems
- 13:29Authorization code flow
- 17:01Authorization code injection
- 24:12PKCE for public clients
- 28:09PKCE in action demo
- 32:02Resources and conclusion
related talks
36mHow To Hack OAuth｜
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
47mHacking OAuth
47mTop X OAuth 2 Hacks
18mHow to Hack OAuth
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security
57mThe insecurity of OAuth 2.0 in frontends
53mOAuth2/OIDC security weaknesses and pitfalls