---
title: "OAuth 2.0 Security Threats and Mitigations"
description: "A comprehensive guide to understanding and mitigating common security threats in OAuth 2.0 implementations"
keywords: ["oauth 2.0", "security", "authorization", "authentication", "csrf", "xss"]
category: "security"
---

Authorization code interception is a significant threat in OAuth 2.0 flows, where an attacker can intercept the authorization code sent from the authorization server to the client application. This attack can be mitigated by using the Proof Key for Code Exchange (PKCE) extension, as defined in RFC 7636, which requires the client to generate a cryptographically random code verifier and send its transformed value (the code challenge) to the authorization server during the authorization request. The authorization server then validates the code verifier sent by the client in the token request to ensure it matches the earlier code challenge.

Cross-Site Request Forgery (CSRF) attacks on the redirect URI are another common threat, where an attacker can trick the user into making an unauthorized request to the client application's redirect URI, potentially allowing the attacker to obtain an access token or authorization code. To mitigate this, clients should implement CSRF protection, such as using a CSRF token, and validate the state parameter returned by the authorization server to ensure it matches the expected value.

Token leakage via the referrer header is a risk, as access tokens or authorization codes may be exposed in the referrer header when the user is redirected back to the client application. To address this, clients should use the "response_mode=query" parameter to ensure the authorization code is returned in the query string rather than the fragment component of the redirect URI, which is more susceptible to leakage.

Mix-up attacks occur when an attacker tricks the client application into sending the user to the wrong authorization server, potentially allowing the attacker to obtain an access token or authorization code. To mitigate this, clients should carefully validate the issuer and audience claims in the ID token returned by the authorization server, as defined in the OpenID Connect specification.

Open redirector exploitation is a threat where an attacker can trick the client application into redirecting the user to a malicious website, potentially allowing the attacker to obtain an access token or authorization code. To mitigate this, clients should carefully validate the redirect URI to ensure it matches a pre-registered, trusted value.

PKCE downgrade attacks are a threat where an attacker can trick the client application into using a less secure PKCE method, such as "plain" instead of "S256". To mitigate this, clients should always use the "S256" code challenge method, as defined in RFC 7636, and carefully validate the response from the authorization server to ensure the correct PKCE method was used.

Proof of Possession (DPoP), as defined in RFC 9126, is a mitigation technique that can help prevent token theft via Cross-Site Scripting (XSS) attacks. DPoP requires the client to prove possession of a private key corresponding to a public key sent to the authorization server, which the authorization server can then use to validate that the token is being used by the intended client.

Finally, the Pushed Authorization Requests (PAR) extension, defined in RFC 9126, provides an alternative to the traditional redirect-based OAuth 2.0 flow. PAR allows the client to push the authorization request to the authorization server, rather than redirecting the user, which can help mitigate several security threats, such as open redirector exploitation and CSRF on the redirect URI.In addition to the security threats and mitigations already discussed, OAuth 2.0 implementations must also be vigilant against the risk of token theft via Cross-Site Scripting (XSS) attacks. XSS vulnerabilities in the client application or authorization server can allow an attacker to steal access tokens or authorization codes, which can then be used to impersonate the victim and gain unauthorized access to protected resources. To mitigate this threat, clients and authorization servers should implement robust input validation and output encoding mechanisms, as well as leverage security features like Content Security Policy (CSP) and HttpOnly/Secure cookies.

Another critical security consideration for OAuth 2.0 is the potential for attackers to exploit the token introspection endpoint, as defined in RFC 7662. The token introspection endpoint allows a resource server to validate an access token by sending it to the authorization server for verification. If this endpoint is not properly secured, an attacker could potentially use it to obtain sensitive information about a user's access tokens, such as their expiration time or the associated scope. To prevent this, resource servers should ensure that token introspection requests are only accepted from trusted sources and that the responses are carefully parsed and validated to avoid leaking sensitive token details.

The OAuth 2.0 Device Authorization Grant, as specified in RFC 8628, introduces additional security considerations for OAuth 2.0 implementations that support device-based flows. In this flow, a user initiates an authorization request from a device with limited input capabilities, such as a smart TV or IoT device, and completes the authorization process on a separate device, such as a smartphone or computer. Attackers may attempt to exploit this flow by intercepting the user code or device code and using it to obtain an access token. To mitigate this threat, clients should implement robust user verification mechanisms, such as requiring the user to enter a one-time code displayed on the device, and carefully validate the authorization response to ensure it is associated with the correct device.

Finally, the OAuth 2.0 Dynamic Client Registration Protocol, as defined in RFC 7591, provides a mechanism for clients to register themselves with an authorization server. While this feature can simplify the onboarding process for new clients, it also introduces potential security risks if not properly secured. Attackers could attempt to register malicious clients or exploit vulnerabilities in the client registration endpoint to gain unauthorized access to protected resources. To mitigate these risks, authorization servers should implement strict validation of client registration requests, including verifying the client's identity and ensuring that the requested redirect URIs and other configuration parameters are valid and trusted.In addition to the security threats and mitigations already discussed, OAuth 2.0 implementations must also consider the risks associated with the use of the Resource Indicator extension, as defined in RFC 8707. This extension allows clients to specify the resource server that should process the access token, which can help prevent token replay attacks across different resource servers. However, if not implemented correctly, the resource indicator can also be exploited by attackers to trick the authorization server into issuing tokens for the wrong resource server. To mitigate this threat, clients and authorization servers should carefully validate the resource indicator parameter to ensure it matches the expected value, and implement additional safeguards, such as binding the resource indicator to the client's registered redirect URI.

Another important security consideration for OAuth 2.0 is the potential for attacks targeting the token revocation endpoint, as defined in RFC 7009. This endpoint allows clients and resource servers to revoke access tokens that are no longer needed, which can help mitigate the impact of token theft or misuse. However, if the token revocation endpoint is not properly secured, an attacker could attempt to revoke valid tokens belonging to other users or clients, potentially disrupting their access to protected resources. To prevent this, authorization servers should implement robust authentication and authorization checks on the token revocation endpoint, and ensure that only authorized parties are able to revoke tokens.

The OAuth 2.0 Security Best Current Practice (BCP) document, as specified in RFC 8252, provides additional guidance on securing OAuth 2.0 implementations. This BCP recommends a number of security practices, such as the use of the "state" parameter to prevent CSRF attacks, the implementation of the "response_mode=query" parameter to mitigate token leakage via the referrer header, and the adoption of the Proof Key for Code Exchange (PKCE) extension to prevent authorization code interception. Authorization servers and clients should carefully review and implement the recommendations outlined in this BCP to enhance the overall security of their OAuth 2.0 deployments.

Finally, the OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens specification, as defined in RFC 8705, introduces an additional layer of security for OAuth 2.0 implementations. This specification allows clients to authenticate themselves to the authorization server using mutual TLS, and it also enables the issuance of access tokens that are bound to the client's certificate. This can help mitigate the risk of token theft and unauthorized access, as the access token can only be used by the client that was issued the corresponding certificate. Authorization servers and clients should consider implementing this specification to further strengthen the security of their OAuth 2.0 deployments.In addition to the security threats and mitigations already discussed, OAuth 2.0 implementations must also be aware of the potential for attackers to exploit the OAuth 2.0 token revocation endpoint, as defined in RFC 7009. This endpoint allows clients and resource servers to revoke access tokens that are no longer needed, which can help mitigate the impact of token theft or misuse. However, if the token revocation endpoint is not properly secured, an attacker could attempt to revoke valid tokens belonging to other users or clients, potentially disrupting their access to protected resources. To prevent this, authorization servers should implement robust authentication and authorization checks on the token revocation endpoint, and ensure that only authorized parties are able to revoke tokens.

Another critical security consideration for OAuth 2.0 is the potential for attackers to exploit the token introspection endpoint, as defined in RFC 7662. The token introspection endpoint allows a resource server to validate an access token by sending it to the authorization server for verification. If this endpoint is not properly secured, an attacker could potentially use it to obtain sensitive information about a user's access tokens, such as their expiration time or the associated scope. To prevent this, resource servers should ensure that token introspection requests are only accepted from trusted sources and that the responses are carefully parsed and validated to avoid leaking sensitive token details.

The OAuth 2.0 Device Authorization Grant, as specified in RFC 8628, introduces additional security considerations for OAuth 2.0 implementations that support device-based flows. In this flow, a user initiates an authorization request from a device with limited input capabilities, such as a smart TV or IoT device, and completes the authorization process on a separate device, such as a smartphone or computer. Attackers may attempt to exploit this flow by intercepting the user code or device code and using it to obtain an access token. To mitigate this threat, clients should implement robust user verification mechanisms, such as requiring the user to enter a one-time code displayed on the device, and carefully validate the authorization response to ensure it is associated with the correct device.

The OAuth 2.0 Dynamic Client Registration Protocol, as defined in RFC 7591, provides a mechanism for clients to register themselves with an authorization server. While this feature can simplify the onboarding process for new clients, it also introduces potential security risks if not properly secured. Attackers could attempt to register malicious clients or exploit vulnerabilities in the client registration endpoint to gain unauthorized access to protected resources. To mitigate these risks, authorization servers should implement strict validation of client registration requests, including verifying the client's identity and ensuring that the requested redirect URIs and other configuration parameters are valid and trusted.