OAuth best practices: We read RFC 9700 so you don’t have to

TL;DR: Best practices summary

That brings us to tl;dr: best practices summary. Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Protect redirect-based flows

Protect redirect-based flows is where this gets concrete. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

• Validate signature, issuer, audience and expiry as four separate checks
• Normalize provider attributes into one internal shape
• Fail loudly when a peer stops meeting a documented assumption
• Keep a fixture per provider so regressions surface in CI

Prevent token replay attacks

Prevent token replay attacks is where this gets concrete. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Limit the scope of access tokens

Limit the scope of access tokens is where this gets concrete. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Normalization is the whole job.

Don’t use password-based authentication

Don’t use password-based authentication deserves its own treatment. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Don’t use the implicit grant

That brings us to don’t use the implicit grant. Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Use strong client authentication

Use strong client authentication deserves its own treatment. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Where this leaves us

None of this is exotic. It is the ordinary discipline of deciding what you own, writing down what you assume, and making the failures loud enough to notice.

If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.