RFC 9700: Best Current Practice for OAuth 2 0 Security

Depending on the grant type, either a code or token is sent via the victim’s browser to the /callback endpoint specified in the redirect_uri parameter of the authorization request. If an external OAuth service is used, you should be able to identify the specific provider from the hostname to which the authorization request is sent. The most reliable way to identify OAuth authentication is to proxy your traffic through Burp and check the corresponding HTTP messages when you use this login option. The security relies almost entirely on developers using the right combination of configuration options and implementing their own additional security measures on top, such as robust input validation. When sending the authorization response or token response via postMessage, the authorization server may not check the receiver origin against the redirection URI and instead, for example, may send the response to an origin provided by an attacker. For confidential clients, RFC6749 already requires that refresh tokens can only be used by the client for which they were issued.¶

This attack will not work as easily for confidential clients, since the code exchange requires authentication with the legitimate client’s secret. If the attacker impersonates a public client, the attacker can exchange the code for tokens at the respective token endpoint.¶ This approach allows clients to encode transaction state into additional redirect URI parameters or to register a single pattern for multiple redirection URIs.¶ Some authorization servers allow clients to register redirection URI patterns instead of complete redirection URIs.

If you’re completely new to OAuth, we recommend familiarizing yourself with the details of both of the grant types we’re going to cover before reading further. Although OAuth 2.0 is the current standard, some websites still use the legacy version 1a. However, the same mechanism is also used to provide third-party authentication services, allowing users to log in with an account that they have with a different website. The basic OAuth process is widely used to integrate third-party functionality that requires access to certain data from a user’s account.

• When security teams discover a compromise, standard response procedures include forcing password resets, requiring MFA re-enrollment, and terminating active sessions.
• OAuth is a protocol for extending user authorization across multiple applications without sharing the user’s identity authentication data with those applications.
• By the time security teams notice unusual activity, attackers have already exfiltrated massive datasets.
• In those cases, the OAuth protocol is used behind the scenes to enable those external apps to access the necessary data from Google.
• The page rendered as a result of the OAuth authorization response and the authorization endpoint SHOULD NOT include third-party resources or links to external sites.¶

Impact

The victim, interacting entirely with legitimate Microsoft infrastructure, enters the code and completes whatever MFA challenge their tenant enforces. The attacker initiates the attack by sending a POST request to Microsoft’s device authorization endpoint with a chosen client_id, receiving in response a user_code (a short alphanumeric string), a device_code, a verification_uri, and an expiration window — typically fifteen minutes. Proofpoint documented a sharp volumetric increase in device code phishing activity beginning in September 2025 and identified a financially motivated threat actor, designated TA2723, adopting the method by October 2025 . Concurrent with Microsoft’s disclosure, the threat intelligence firm Volexity published findings linking at least two additional Russia-affiliated clusters — tracked as UTA0304 and UTA0307 — to the same technique, suggesting independent parallel development or knowledge-sharing within the Russian intelligence community . If you store the secret in a way that can be displayed later to developers, you should take extra precautions when revealing the secret. This way when developers copy and paste the ID and secret, it is easy to recognize which is which.

Ready to make SSOJet – Enterprise SSO & Identity Solutions a business advantage? Sign up today.

At the authorization endpoint, a typical protocol flow is that the authorization server prompts the user to enter their credentials in a form that is then submitted (using the HTTP POST method) back to the authorization server. Preventing server breaches by hardening and monitoring server https://www.softforsale.com/14012/download-anpr.html systems is considered a standard operational procedure and, therefore, out of the scope of this document. Beyond this, to prevent PKCE downgrade attacks, the authorization server MUST ensure that if there was no code_challenge in the authorization request, a request to the token endpoint containing a code_verifier is rejected.¶

Data extracted over 24 hours

Attackers can use automated tools to identify active guest accounts within a tenant, test them for weaknesses, and gain access through dormant accounts. Guest accounts receive the same permissions as internal employees, including privileged access. Static inventory cannot identify tokens being abused by attackers. Detection requires behavioral analysis since legitimate and compromised tokens generate identical API traffic.

• This way when developers copy and paste the ID and secret, it is easy to recognize which is which.
• Implementation challenges limit widespread adoption.
• Token revocation requires an explicit call to the revokeSignInSessions API or an equivalent administrative action in Microsoft Entra ID .
• However, Huntress warned that customer data may have been compromised, including business names, products trialed/used, subscription details, business contact information and marketing and sales communications.
• Attackers gained access to CircleCI’s production environment and exfiltrated customer secrets, including API tokens, encryption keys, and service credentials.
• OAuth scopes requesting full mailbox access, complete file system read/write, or administrative privileges warrant immediate review.

ASNs identify the network operator, providing stable indicators of infrastructure source. But this requires baseline knowledge of normal token usage patterns. Autonomous System https://biznisnovine.com/short-course-on-what-you-should-know/ Numbers identify network operators.

When properly implemented, OAuth 2.0 is a robust and secure protocol. RFC 9700 suggests that developers should constantly review the latest security research, update their OAuth implementation regularly, and be aware of emerging risks. RFC 9700 recommends that developers use the Authorization Code Flow with PKCE (Proof Key for Code Exchange) for public clients (i.e., mobile and single-page web apps). With ROPC, the application can access anything the user has permission for, including sensitive information they may not want to share. In https://www.electionsscotland.info/5-takeaways-that-i-learned-about-3/ an OAuth 2.0 flow, tokens—whether access tokens or authorization codes—are meant to be used by authorized clients for specific purposes and for limited timeframes. However, attackers can manipulate redirect URIs to steal authorization codes or tokens.