OAuth 2.0 Authentication Vulnerabilities
The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give you something to do on my behalf).<p>If you want a list of things that can go wrong, look here: <a href="https://tools.ietf.org/id/draft-ietf-oauth-security-topics-10.html" rel="nofollow">https://tools.ietf.org/id/draft-ietf-oauth-security-topics-1...</a><p>Generally you probably do not need OAuth2: <a href="https://www.ory.sh/hydra/docs/concepts/before-oauth2/" rel="nofollow">https://www.ory.sh/hydra/docs/concepts/before-oauth2/</a><p>But if you do don’t roll your own but use proven open source like <a href="https://github.com/ory/hydra" rel="nofollow">https://github.com/ory/hydra</a>