Breaking and securing OAuth 2.0 in frontends at NDC Security

on YouTube ↗01h 00m

" summary

Demo web app and attacker server show malicious script steals tokens (exfiltrates access + refresh tokens to attacker domain) and a second demo uses a silent iframe authorization code theft to obtain fresh tokens that bypass refresh token rotation. Claim: running OAuth2 flows in the browser increases attack surface and is repeatedly exploitable. Built proof‑of‑concept code works reliably. Practical fix: adopt a Backend-For-Frontend (BFF) (confidential client, HTTP‑only cookies) which removes most token theft vectors though client‑side XSS still enables request‑forging.

AI-written summary · about

" chapters (8)

1. 0:00OAuth 2.0 and frontend security
2. 10:44Direct OAuth in frontends insecure
3. 23:58Refresh token rotation limits
4. 29:14OAuth token theft risks demo
5. 37:51OAuth frontend vs backend security
6. 41:00Backend for Frontend (BFF) pattern
7. 56:00BFFs improve OAuth security
8. 58:13Key takeaways

" related talks

• 57mThe insecurity of OAuth 2.0 in frontendsPhilippe De Ryck · NDC Security 2023
• 53mOAuth2/OIDC security weaknesses and pitfallsTobias Ahnoff, Pontus Hanssen · NDC Security 2024
• 47mTop X OAuth 2 HacksAntonio Sanso · Voxxed Days Ticino 2017
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 01h 03mSecuring SPAs and Blazor Applications using the BFF (Backend for Frontend) PatternDominick Baier · NDC Security 2023
• 33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth FlowsBhaumik Shah · BSidesSF 2026
• 37mHacking OAuth Pitfalls and RemediesMicah Silverman · Devnexus 2021
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016