OAuth and OpenID Connect

Redirect users only to destinations you control

Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.

Design, Development · Developers

Case study: the CircleCI security incident (January 2023)

How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.

Release, Maintenance · Platform engineers and SREs

OAuth 2.0 and OpenID Connect login: authorization code with PKCE

Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.

Development · Developers

JWT validation: algorithms, keys, claims and key rollover

Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.

Development · Developers

Defend OAuth and OIDC against redirect and token attacks

Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.

Development · AppSec engineers

Constrain MCP and multi-agent trust boundaries

Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.

Design, Development · Developers

JWT validation lab: Validate the purpose and audience of a token

An API accepts a correctly signed token intended for another service. Repair claim validation after the trusted signature verifier has finished.

JWT verification lab: Verify a JWT before trusting it

An API decodes the JWT it receives and trusts the claims without checking the signature or the algorithm, so an attacker can forge an admin token with alg "none" or sign one with a key the API never issued. Repair the verifier so it confirms the algorithm and signature first, then the claims.

Open redirect lab: Return users to this site only

After sign-in, the login page redirects to whatever its next parameter says, so a link to your own domain can end on a look-alike site. Return users only to a page on this site.

OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE

An authorization server accepts any redirect_uri that starts with a registered one, skips PKCE for codes issued without a challenge and accepts the plain method. Repair both checks so stolen or injected codes cannot be redeemed.