OAuth 2.0
: An authorization framework that enables third-party applications to obtain limited access to a web service on behalf of a user, without exposing the user’s credentials. OAuth 2.0 defines four grant types (authorization code, implicit, client credentials, device code) for different use cases.
Why It Matters for AI-Coded Apps
AI-generated OAuth implementations frequently contain security flaws: missing state parameter (enabling CSRF), using the implicit flow (deprecated), not validating redirect URIs, or storing tokens insecurely. OAuth is complex, and LLMs often generate simplified versions that skip critical security steps.
Real-World Example
The Authorization Code flow: 1) App redirects user to https://auth.provider.com/authorize?client_id=X&redirect_uri=Y&state=Z&response_type=code. 2) User authenticates and approves. 3) Provider redirects back with an authorization code. 4) App exchanges the code for tokens server-side. 5) App uses the access token for API calls.
How to Detect and Prevent It
Always use the Authorization Code flow with PKCE (even for server-side apps). Validate the state parameter to prevent CSRF. Validate redirect URIs on the server against a strict allowlist. Store tokens securely (HttpOnly cookies or encrypted server-side storage). Use established libraries (NextAuth, Passport, Auth0 SDK) instead of implementing OAuth from scratch.
Frequently Asked Questions
What is the difference between OAuth 2.0 and OIDC?
OAuth 2.0 is an authorization framework (granting access to resources). OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds authentication (verifying who the user is). OIDC adds an ID token containing user identity claims. Use OIDC when you need to know who the user is, not just grant access.
What is PKCE and why do I need it?
Proof Key for Code Exchange (PKCE) prevents authorization code interception attacks. The client generates a random code_verifier and sends a hashed code_challenge with the authorization request. When exchanging the code for tokens, the client sends the original code_verifier, proving it initiated the flow. Required for public clients, recommended for all.
Should I implement OAuth myself or use a library?
Use a library or service (NextAuth, Passport, Auth0, Clerk). OAuth 2.0 has many security-critical details (state validation, PKCE, token storage, redirect URI validation) that are easy to get wrong. Even experienced developers introduce vulnerabilities in custom implementations.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval