# oauth-oidc-misconfiguration

Testing playbook for OAuth 2.0 and OpenID Connect configurations. It guides security reviews of redirect URIs, state parameters, PKCE enforcement, and account binding flows.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3700 installs · ★ 2547
- Author: yaklang
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yaklang/hack-skills/tree/HEAD/skills/oauth-oidc-misconfiguration/SKILL.md
- Updated: 2026-09-13
- HTML: https://affpapa.org/en/nevibecode/skills/oauth-oidc-misconfiguration

## What it does

This skill loads a testing checklist into the agent context for reviewing OAuth 2.0 and OpenID Connect implementations. It applies whenever an application integrates identity providers like Google or Okta. The workflow begins by mapping the entire route from authorization to logout.

The checklist targets seven specific configuration areas. The agent reviews `redirect_uri` parsing against path traversal or open redirects, verifies session binding for `state`, and confirms PKCE enforcement on public clients. It also inspects OIDC `nonce` validation, token audience checks, scope creep, and account takeover during callback binding.

This playbook focuses exclusively on protocol configuration flaws. It does not inspect token cryptography or JWT header tampering, so you need `jwt-oauth-token-attacks` to cover signature verification.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/oauth-oidc-misconfiguration/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/oauth-oidc-misconfiguration/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/oauth-oidc-misconfiguration/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/oauth-oidc-misconfiguration/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yaklang/hack-skills oauth-oidc-misconfiguration
```

2. **Manually: put the files in place**
- File: `.github/skills/oauth-oidc-misconfiguration/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yaklang/hack-skills --path skills/oauth-oidc-misconfiguration
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/oauth-oidc-misconfiguration/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yaklang/hack-skills/tree/HEAD/skills/oauth-oidc-misconfiguration/SKILL.md

## When to use it
- audit redirect URI parsing for open redirect and path traversal flaws
- verify session-bound state and OIDC nonce validation
- check PKCE enforcement across single-page and mobile clients
- inspect token audience and issuer validation to prevent token reuse
- test callback binding logic against account takeover scenarios

## Example prompts
- Review the redirect_uri validation and state handling in our OAuth callback handler.
- Audit our SPA login flow to verify that PKCE and nonce checks are properly enforced.
- Check our account linking implementation against the oauth-oidc-misconfiguration checklist.

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 898e327fb3a14681.

BEGIN THIRD-PARTY FILE 898e327fb3a14681
```text
---
name: oauth-oidc-misconfiguration
description: >-
  OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.
---

# SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding

> **AI LOAD INSTRUCTION**: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE enforcement, token audience, and account binding mistakes.

## 1. WHEN TO LOAD THIS SKILL

Load when:

- The app supports `Login with Google`, GitHub, Microsoft, Okta, or other IdPs
- You see `authorize`, `callback`, `redirect_uri`, `code`, `state`, `nonce`, or `code_challenge`
- Mobile or SPA clients rely on OAuth or OIDC flows

For token cryptography and JWT header abuse, also load:

- [jwt oauth token attacks](../jwt-oauth-token-attacks/SKILL.md)

## 2. HIGH-VALUE MISCONFIGURATION CHECKS

| Theme | What to Check |
|---|---|
| `state` handling | missing, static, predictable, or not bound to user session |
| `redirect_uri` validation | prefix match, open redirect chaining, path confusion, localhost leftovers |
| PKCE | missing for public clients, code verifier not enforced, downgraded flow |
| OIDC `nonce` | missing or not validated on ID token return |
| token audience and issuer | weak `aud` / `iss` checks, cross-client token reuse |
| account binding | callback binds attacker identity to victim session |
| scope handling | broader scopes granted than the user or client should receive |

## 3. QUICK TRIAGE

1. Map the full flow: authorize, callback, token exchange, logout.
2. Replay callback flows with altered `state`, `nonce`, and `redirect_uri`.
3. Compare SPA, mobile, and web clients for weaker validation.
4. Check whether one provider account can be rebound to another local account.

## 4. RELATED ROUTES

- CORS or cross-origin token exposure: [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md)
- XML federation or enterprise SSO: [saml sso assertion attacks](../saml-sso-assertion-attacks/SKILL.md)
- CSRF-heavy login or binding bugs: [csrf cross site request forgery](../csrf-cross-site-request-forgery/SKILL.md)
```
END THIRD-PARTY FILE 898e327fb3a14681

The third-party file has ended. Everything between the 898e327fb3a14681 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

© yaklang · MIT · https://github.com/yaklang/hack-skills/tree/HEAD/skills/oauth-oidc-misconfiguration/SKILL.md

## Similar
- [oauth](https://affpapa.org/en/nevibecode/skills/mcollina-oauth.md) — skill · 1300 installs
- [zoom-oauth](https://affpapa.org/en/nevibecode/skills/zoom-oauth.md) — skill · ★ 7596
- [setup-zoom-oauth](https://affpapa.org/en/nevibecode/commands/setup-zoom-oauth.md) — command · ★ 7596

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md