oauth-implementation

From README

OAuth/OIDC Implementation Security (OWASP A07:2025) What this checks Prevents authentication bypasses from weak JWT validation, open redirects from loose redirecturi matching, and CSRF from missing state parameters. These flaws allow account takeover and session hijacking. Vulnerable patterns JWT decode call that accepts the none algorithm, or accepts an attacker-supplied algorithm header — enabling algorithm-confusion bypass. redirecturi validated by prefix match, substring match, or regex — letting an attacker host a lookalike domain whose URL passes the check. JWT decode that omits audience (aud) validation — a token minted for a sibling service passes signature verification but should not be honored here. Tokens stored in browser web storage (e.g. localStorage) where any same-origin script can read them. OAuth authorization request sent with no state parameter, or with a state that is not bound to and verified against the initiating session.