Security Issues In OAuth/OIDC Implementations
summary
Analyzes OAuth/OIDC implementations in mobile apps with concrete findings and fixes: 87 apps analyzed from Google Play reveal 6 compliant and widespread faults — 38 use official SDKs, 49 use custom flows; common problems are missing PKCE, continued use of implicit flow, webviews, plaintext client secrets, and redirect hijacking. Recommends certified SDKs, PKCE for native clients, custom tabs or app links for redirects, dynamic client registration for legacy secrets, and presents an Android Studio plugin that injects AppAuth-based code enforcing RFC 8252.
AI-written summary · about
chapters (14)
- 0:00Introduction to OAuth/OIDC
- 1:06OAuth basics and examples
- 3:56Implementation challenges in OAuth
- 6:25Security best practices updates
- 7:09Access token leakage risks
- 8:11PKCE for code injection protection
- 11:21Mix-up attack prevention
- 14:33PKCE downgrade attacks
- 17:45Nonce and PKCE interaction risks
- 19:32BCP recommendations by sector
- 20:37Native apps essential practices
- 23:26MeetAssistant plugin demo
- 24:28Experimental analysis findings
- 26:38Key takeaways and conclusion
related talks
47m1000 Ways to Die in Mobile Oauth
18mHow to Hack OAuth
36mOAuth Done Right: Secure Authentication for Androi…
01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId Connect
47mHacking OAuth
36mHow To Hack OAuth｜
15mAvoiding Security and Privacy Issues in SDK Integration
47mTop X OAuth 2 Hacks