OAuth2/OIDC security weaknesses and pitfalls
summary
Shows live demos using Burp Suite, IdentityServer and Keycloak: a cross‑site scripting exploit loads attacker JavaScript that creates a silent renew iframe to steal an authorization code and exchange it for an access token, proving tokens in browser are unsafe; refactoring to a BFF with a confidential client and secure HTTP‑only cookie stops token theft but still permits session‑writing; a reverse-proxy catch-all lets a BFF forward requests to an internal /orders/all endpoint until a strict allowlist fixes routing; reports a Keycloak wildcard redirect URI bug (patched in 23.0.4).
AI-written summary · about
chapters (21)
- 0:00OAuth2/OIDC security challenges
- 1:11Backend-for-frontend security
- 3:172019 OAuth2 risks
- 6:07XSS token theft demo
- 10:33Frontend token dangers
- 12:00Refactoring to secure BFF
- 14:07Secure BFF defense demo
- 17:43Routing misconfigurations
- 23:04Conditions for exploits
- 25:11OAuth2 security principles
- 25:53API routing fixes
- 27:20BFF scope challenges
- 27:42Modifiable auth requests
- 31:24Redirect URI flaws
- 35:17Keycloak redirect flaw demo
- 37:09Avoid wildcard OAuth2
- 38:32Scope-based attacks defense
- 39:37Global tokens risks
- 41:46Token exchange for least privilege
- 43:11Best practices summary
- 45:26Q&A mobile multi-tenant
related talks
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
57mThe insecurity of OAuth 2.0 in frontends
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
47mTop X OAuth 2 Hacks
59mSecuring Web APIs from JavaScript/SPA Applications
01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId Connect