OAuth Security

• OAuth 2.0 Threat Model and Security Considerations (ietf.org)
• OAuth 2.0 Security Best Current Practice (ietf.org)
• Security Considerations when Building an Authorization Server (oauth.com)
• OAuth 2.0 Security Considerations (ldapwiki.com)
• A Comprehensive Formal Security Analysis of OAuth 2.0 (arxiv.org, PDF)

Security Workshops

The OAuth Security Workshop (OSW) aim is to improve the security of OAuth and related Internet protocols by a direct exchange of views between academic researchers, IETF OAuth Working Group members and industry.

See upcoming workshops

Security Advisories

The OAuth community is committed to identifying and addressing any security issues raised relating to the OAuth protocol and extensions. Any identified threat will be published on this page as soon as it is safe to do so. Due to the nature of many security threats, they cannot be disclosed before sufficient notice is given to vulnerable parties.

The following are known security threats and the protocol version they affect:

OAuth 2.0

• 2014.1 Covert Redirect

OAuth Core 1.0

• 2009.1 Session Fixation Attack

How to Report Security Threats

Please report any concerns with specific products to the vendor of that product using their own vulnerability reporting mechanisms.

For security concerns related to the spec itself, please refer to the IETF Guidance on Reporting Protocol Vulnerabilities.