# OAuth Misconfiguration

> Detects common OAuth 2.0 implementation mistakes including missing state parameter, open redirect in redirect_uri, and token exposure.

- Skill: `zakirkun/oauth-misconfiguration` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/oauth-misconfiguration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/oauth-misconfiguration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/oauth-misconfiguration

---


# OAuth Misconfiguration

## Overview
OAuth 2.0 implementations are prone to several security issues:
1. **Missing `state` parameter**: Makes the OAuth flow vulnerable to CSRF attacks
2. **Open redirect in `redirect_uri`**: Allows token theft by redirecting to attacker-controlled URL
3. **Implicit flow usage**: The OAuth implicit flow exposes tokens in URL fragments
4. **Token in URL**: Access tokens logged in server logs or browser history
5. **Client secret exposure**: OAuth client secrets hardcoded or leaked

## Detection Strategy
- Check authorization URL construction for missing `state` parameter
- Detect use of deprecated implicit grant type (`response_type=token`)
- Find hardcoded client secrets
- Detect redirect_uri validation that allows wildcards or subdomains

## Remediation
- Always include a cryptographically random `state` parameter
- Use PKCE for public clients instead of implicit flow
- Validate `redirect_uri` against an exact allowlist
- Store client secrets in environment variables, never in code

**Vulnerable:**
```python
auth_url = f"https://auth.example.com/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={uri}&response_type=token"
```

**Safe:**
```python
import secrets
state = secrets.token_urlsafe(32)
session['oauth_state'] = state
auth_url = f"https://auth.example.com/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={FIXED_URI}&response_type=code&state={state}"
```