OAuth Security Best Practices: PKCE, Redirect URIs, Refresh Rotation, and DPoP
OAuth is secure only when the authorization flow, redirect handling, token privileges, and refresh lifecycle are implemented deliberately. RFC 9700 is the current OAuth 2.0 Security Best Current Practice.
Use Authorization Code + PKCE
Public clients must use PKCE under RFC 9700, and PKCE is recommended for confidential clients too.
Use S256, generate a new verifier/challenge per transaction, and verify the code only with the matching verifier.
Register Redirect URIs Exactly
Authorization servers should use exact redirect-URI matching except for the defined localhost-port exception for native apps.
Avoid wildcard redirects and open redirectors. A loose redirect rule can leak authorization codes or tokens to an attacker-controlled destination.
Avoid Legacy Implicit Token Delivery
RFC 9700 recommends code-based flows instead of returning access tokens directly through the browser authorization response. Authorization Code enables stronger replay protections and keeps access tokens out of redirect URLs.
Restrict Token Authority
Access tokens should be narrowly scoped and audience-restricted to the intended resource server where possible.
The API must validate that a presented token was actually issued for that API and use case.
Protect Refresh Tokens
For public clients, RFC 9700 requires refresh-token replay detection through either:
- refresh-token rotation, or
- sender-constrained refresh tokens.
With rotation, each refresh returns a new refresh token and invalidates the previous one, allowing reuse of an old token to signal compromise.
Consider Sender-Constrained Access Tokens
Normal bearer tokens can be replayed by whoever steals them. Standards such as DPoP (RFC 9449) bind token use to proof of possession of a client key, reducing some stolen-token replay scenarios.
Use sender-constraining when the threat model justifies the added client/key-management complexity.
Final Takeaway
Modern OAuth security is mostly about code + PKCE, exact redirect URIs, narrow token authority, safe refresh-token replay detection, and avoiding legacy browser token flows. Do not treat the authorization server's successful response as proof that the surrounding client/API implementation is secure.
References
BUILDING A SAAS PRODUCT?
Explore Lofingo’s end-to-end SaaS platforms, multi-tenant cloud architecture, and high-concurrency backend engineering.
EXPLORE SAAS SERVICES →