OAuth 2.0, OpenID Connect and JWT security
You follow the authorisation code flow, PKCE and the ID token step by step, and find, fix and retest redirect_uri, state and JWT validation mistakes in the lab single sign-on set-up.
Level 301 · 18 lessons · 15 practice labs
Lessons
OAuth 2.0
- OAuth roles: resource owner, client, authorisation server and resource server
- The authorisation code flow step by step
- PKCE: protecting the code in public clients
- Following an OAuth flow with Burp
- Short task: draw the lab app’s sign-in flow and explain each parameter
OAuth mistakes
- redirect_uri validation: loose matching and code leakage
- The state parameter and login CSRF
- Scopes and consent: clients asking for too much
- Short task: evidence two OAuth mistakes and close them on the authorisation server
OpenID Connect
- The ID token: claims, nonce and audience
- The discovery document and JWKS: how keys are found
- Account linking mistakes: trusting an unverified e-mail
- Short task: write code that validates the ID token completely
JWT in depth
- Algorithms: HS256, RS256 and algorithm confusion
- Header parameters: the risks of kid, jku and x5u
- Lifetime, refresh and revocation lists
- Choosing a library and safe defaults
- Capstone: audit, fix and retest a single sign-on set-up
Practice labs
- Draw the login flow: what each parameter does: Follow the lab client app's authorisation code flow with Burp and put the job of each parameter in every redirect into a table.
- A login with no state parameter: Show the flow uses no state parameter, explain how it leads to login CSRF and add state validation to the client.
- Loose redirect_uri matching: Prove the authorisation server accepts redirect_uri by prefix matching and change it to exact matching.
- A public client without PKCE: Show the single-page client does not use PKCE, require PKCE on client and server and prove the code alone is useless.
- A client that asks for too much scope: Find that the second lab client receives scopes it does not need, narrow them and fix the consent screen to reflect reality.
- Decode the ID token and read its claims: Decode an ID token, explain the iss, aud, exp and nonce claims and find which ones the client fails to check.
- A missing audience check: Prove an ID token issued for another client is accepted and add the aud check.
- Account linking with an unverified email: Show in the lab that an unverified email from the provider takes over an existing account and switch to linking by email_verified and the sub claim.
- Code that fully validates an ID token: Write a function that checks signature, iss, aud, exp and nonce with a key from JWKS and test it with five faulty tokens.
- Single sign-on review: Selvara Identity: Review the fictional Selvara Identity setup for OAuth, OIDC and JWT weaknesses, close them and retest the whole flow.
- An access token that never expires: Show tokens without an exp claim are accepted, require a short lifetime and test that an expired token is refused.
- An unsafe default in the JWT library: Find that the verify call passes no algorithm list and pin it with safe defaults.
- Algorithm confusion: HS256 instead of RS256: Prove in the lab that the server accepts the public key as an HMAC key and lock verification to one algorithm.
- A file path through the kid header: Prove the kid value mixes into the key file path and bind kid to a fixed key ID map.
- An outside key set through jku: Prove the server downloads keys from the address in the jku header and limit the key source to the JWKS address in configuration.
About this course
You follow the authorisation code flow, PKCE and the ID token step by step, and find, fix and retest redirect_uri, state and JWT validation mistakes in the lab single sign-on set-up.
What you will learn
- OAuth 2.0
- OAuth mistakes
- OpenID Connect
- JWT in depth
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.