OAuth from First Principles (stack-auth.com)

Article summary

The article explains the OAuth authorization framework from first principles, starting with a flawed implementation and iteratively improving it to arrive at the OAuth 2.0 authorization code flow with PKCE. It discusses various attacks and mitigations, such as redirect URI manipulation, cross-site request forgery, and eavesdropping. The article aims to provide a clear understanding of the OAuth flow and its security considerations. The author also mentions that implementing OAuth from scratch is not recommended and that the article is not a production-ready guide.

Main themes

• OAuth authorization
• Security considerations
• Authorization code flow
• PKCE
• Token management
• Auth0 alternatives

What commenters say

• The implicit flow is not recommended for static sites due to security concerns, and the code flow with refresh tokens may be a better option.
• Storing tokens in local storage is a common practice, but it may not be the most secure approach, and alternatives like HTTP-only cookies should be considered.
• The choice between implicit and code flow depends on the specific threat model and risk assessment of the application.
• Some argue that the code flow can be done on the client-side, but others claim that it is not possible due to CORS issues.
• The use of refresh tokens and access tokens on the client-side poses security risks, and mitigations like token expiration and revocation should be implemented.
• Threat modeling is essential to determine the appropriate OAuth flow and token management strategy for a specific application.
• The OAuth specification and implementations may have limitations and variations, and developers should be aware of these differences when choosing an authentication solution.