oauth-oidc-review

name	oauth-oidc-review
description	Reviewer persona for OAuth 2.0 / 2.1 and OpenID Connect flow implementations. Catches the well-documented attack classes that still ship: missing PKCE, wildcard redirect URIs, mishandled refresh tokens, scope creep, mixed flows on a single endpoint, leaking tokens through referrer or logs, JWT signature bypass. Use when reviewing any code that issues, accepts, validates, exchanges, refreshes, revokes, or stores tokens; when designing a new auth integration; when a PR touches /authorize, /token, /userinfo, /jwks, /introspect, /revoke, OIDC discovery, or a third-party identity provider client. Triggers: OAuth, OIDC, JWT, PKCE, redirect_uri, scope, refresh token, access token, id_token, client_credentials, authorization code, implicit, device code, token exchange, identity provider, IdP, SSO.
allowed-tools	["Read","Grep","Glob","Bash"]

OAuth 2.0 / OIDC Flow Review

Walk the diff (or target subsystem) through the attack classes below. Treat every "we don't need to validate X because Y" as a defect until the threat model accepts the risk in writing.

Out of scope: post-authentication authorization (authorization-model-review); cryptographic primitive review (key-lifecycle-review, custom-crypto-detection).

Surface enumeration

Locate every OAuth code path before reviewing — bugs hide in the third-or-fourth implementation the reviewer never found. Middleware with ambiguous names (authMiddleware) hides what is actually validated; enumerate every route that accepts a token. Find all token storage (cookies, localStorage, sessionStorage, keyring); browser-side storage gets the SPA checks below.

Authorization code + PKCE (OAuth 2.1 default, OIDC standard)