OAuth Security - TairinySimeonato/WebAuditing GitHub Wiki
OAuth Storage
The encryption key that is used to encrypt OAuth tokens, before they are stored in the database, must be stored and backed by a physical HSM module.
Some recommendations arE: AWS KMS/Secrets Manager or GCP Cloud HSM.
Also, physical HSM (Yubikey has an HSM thats cost effective) also works
Protect Redirect-Based Flow
clients should avoid forwarding the user's browser to a page obtained from a URL parameter
clients must prevent CSRF
Each authorization response should be accepted only once
state parameter should be random and unique (acts like a csrf token)
client should have least privileges possible within an user's account
connection should be over https and end to end TLS
307 redirect
Session fixation: A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user. An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.