OAuth 2.0 & OIDC Testing

This guide treats OAuth 2.0 authorization servers, OIDC providers, clients, and resource servers as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Inventory issuers, clients, redirect URIs, grants, scopes, audiences, and resource servers.

2. 02

   Separate public, confidential, browser, mobile, machine, and administrative clients.

3. 03

   Record PKCE, state, nonce, consent, token lifetime, and rotation policy.

4. 04

   Use designated clients and identities only.

curl -sS https://id.example.com/.well-known/openid-configuration

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm exact redirect-URI matching and PKCE for public clients.

2. 02

   Verify state and nonce binding in browser flows.

3. 03

   Check issuer, audience, signature, lifetime, and authorized-party validation at resource servers.

4. 04

   Test scope and consent boundaries without requesting real user data.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log authorization decisions, client changes, consent, token rotation, and revocation without raw tokens.
• Alert on redirect changes, replay indicators, anomalous grants, and privileged scopes.
• Correlate provider and resource-server events.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Use Authorization Code with PKCE for interactive clients.
• Strictly register redirects and validate issuer and audience.
• Minimize scopes and token lifetime; rotate refresh tokens.
• Protect client administration and federation metadata changes.