# oauth-implementation

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects weak JWT validation, loose redirect\_uri matching, and missing state parameters in OAuth/OIDC flows. Use when writing OAuth2 or OpenID Connect flows, JWT validation logic, token endpoint handling, or redirect URI processing. Also invoke when implementing any code that parses or verifies JWTs.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/oauth-implementation ~/.claude/skills/oauth-implementation
```

## From README

OAuth/OIDC Implementation Security (OWASP A07:2025) What this checks Prevents authentication bypasses from weak JWT validation, open redirects from loose redirecturi matching, and CSRF from missing state parameters. These flaws allow account takeover and session hijacking. Vulnerable patterns JWT decode call that accepts the none algorithm, or accepts an attacker-supplied algorithm header — enabling algorithm-confusion bypass. redirecturi validated by prefix match, substring match, or regex — letting an attacker host a lookalike domain whose URL passes the check. JWT decode that omits audience (aud) validation — a token minted for a sibling service passes signature verification but should not be honored here. Tokens stored in browser web storage (e.g. localStorage) where any same-origin script can read them. OAuth authorization request sent with no state parameter, or with a state that is not bound to and verified against the initiating session.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/oauth-implementation/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars