oauth-security-anti-pattern

name	oauth-security-anti-pattern
description	Security anti-pattern for OAuth implementation vulnerabilities (CWE-352, CWE-287). Use when generating or reviewing OAuth/OIDC authentication flows, state parameter handling, or token exchange. Detects missing CSRF protection and insecure redirect handling.

OAuth Security Anti-Pattern

Severity: High

Summary

OAuth 2.0/OIDC flows are complex and easily misconfigured. The critical mistake: failing to implement and validate the state parameter. This parameter defends against CSRF attacks during OAuth flows. Missing or predictable state allows attackers to trick victims into logging into the attacker's account, enabling account takeover.

The Anti-Pattern

The anti-pattern is initiating OAuth flows without state parameters, or using predictable values not validated on callback.

BAD Code Example

# VULNERABLE: The OAuth flow is initiated without a `state` parameter.
from flask import request, redirect

OAUTH_PROVIDER_URL = "https://provider.com/auth"
CLIENT_ID = "my-client-id"
CALLBACK_URL = "https://myapp.com/callback"

@app.route("/login/provider")
def oauth_login():
    # Redirects user to OAuth provider.
    # FLAW: No `state` parameter to prevent CSRF.
    auth_url = (f"{OAUTH_PROVIDER_URL}?client_id={CLIENT_ID}"
                )
     redirect(auth_url)


 ():
    
    
    auth_code = request.args.get()
    
    
    access_token = exchange_code_for_token(auth_code)
    log_user_in(access_token)