Single sign-on (OAuth 2.0, OpenID Connect and SAML) is convenient for users, but the protocols are detailed and easy to implement slightly wrong. A small mistake can let an attacker log in as someone else.

How it happens

Typical flaws include a missing state parameter, loose redirect URI matching, using the implicit flow, skipping PKCE, trusting unsigned or wrongly validated ID tokens, and SAML signature-wrapping attacks.

Why it matters

• Account takeover through stolen authorization codes or tokens.
• Login as another user through forged SAML assertions.
• Linking an attacker's account to a victim's identity.

How to prevent it

• Always use and validate the state parameter.
• Match redirect URIs exactly.
• Use the authorization code flow with PKCE; avoid the implicit flow.
• Validate ID token signatures, issuer, audience and expiry.
• Use a well-maintained SAML library and reject unsigned or altered assertions.

How Vooki Pro helps

• Tests OAuth for state, redirect URI, code theft, scope, implicit flow, PKCE and mix-up issues.
• Checks OpenID Connect ID tokens and dynamic client registration.
• Tests SAML for signature wrapping, replay, tampering, comment injection and bypass.
• Reports each issue with evidence and remediation guidance.

Frequently asked questions

Why is PKCE recommended for OAuth?

PKCE stops an intercepted authorization code from being exchanged by an attacker, and is now recommended for all clients.

What is SAML signature wrapping?

An attack that moves or duplicates signed elements in a SAML assertion so the signature still validates while the attacker's identity is used.

Related: Subresource Integrity and third-party scripts · Turn off debug mode and verbose errors in production