{"slug":"oauth-redirect-flow-review","name":"OAuth Redirect Flow Review","version":"1.0.0","updated_at":"2026-10-26T21:00:23.992Z","use_when":"Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow or an access token carried in a URL. It leaves out the safe look-alikes, such as a state kept in a cookie and compared, an exact redirect match, a server-side client with a secret, and a token sent in a header. Use to review a login integration, to audit a single-page app before launch, or to check a gateway that handles redirects.","not_for":"Token signature checks, session storage after login, the setup of an identity provider, SAML and password forms. It reads the pasted code of one sign-in flow and judges only what is written in it.","languages":["en"],"tags":["oauth","oidc","pkce","authentication","redirect-uri","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["login integration","single-page app","redirect address","implicit flow"],"faq":[{"q":"Server-side client with a secret and no PKCE: reported?","a":"No. The line is for clients that cannot keep a secret, such as browser or mobile apps. A web server that authenticates to the token endpoint with its own secret is left alone, as the best-practice document asks PKCE of public clients."},{"q":"State saved in sessionStorage: reported?","a":"No. A saved per-session value that is compared with the returned one before the code is used is the accepted form; the place can be a cookie, the server session or sessionStorage. A state that is set and never compared does earn a line."},{"q":"Which flows went into the test?","a":"Three code samples we wrote ourselves. First, an Express gateway that sets a state cookie but never reads it back and matches redirects by prefix. Second, a browser app with no PKCE that puts its token in a query string. Third, a correct browser app. Each model was given every sample one time."},{"q":"What does a sound flow return?","a":"A single short sentence, No findings., and nothing beside it. Each real mistake is reported on its own line giving code, function, damage and repair, and the parts that were read and judged fine stay unmentioned."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"const express = require('express');\nconst crypto = require('node:crypto');\n\nconst app = express();\n\nconst AUTH_URL = 'https://id.example.com/authorize';\nconst TOKEN_URL = 'https://id.example.com/token';\nconst REGISTERED = [\n  'https://app.example.com/callback',\n  'https://admin.example.com/callback',\n];\n\napp.get('/login', (req, res) => {…","output_excerpt":"STATE-UNCHECKED — `/callback`, never reads `req.query.state` or the `oauth_state` cookie set in `/login` — an attacker can send the victim's browser a callback carrying the attacker's code and complete a login as the wrong account — read the cookie in `/callback`, compare it to `req.query.state`, reject on mismatch, then clear the cookie…"}],"page_url":"https://aiskills402.com/skills/oauth-redirect-flow-review","markdown_url":"https://aiskills402.com/skills/oauth-redirect-flow-review.md","image_url":"https://cdn.aiskills402.com/og/skills/oauth-redirect-flow-review/3ac9de29.png","related_url":"https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/related","purchases_count":null,"tested":{"date":"2026-10-26","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the gateway it found the state cookie that is set and never compared and the redirect matched by prefix, and left out the missing PKCE of a client that holds a secret. On the browser orders app it found the absent PKCE challenge and the access token in a query string, and left out the state kept in sessionStorage and the exact redirect constant. On the clean billing app it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on both planted files, with sound fixes, keeping the confidential client, the sessionStorage state and the exact redirect out of its list. On the first run of the clean billing app it added one STATE-UNCHECKED line, because a returned state and a stored value that are both null would compare equal, and that edge really was in our clean input. The input was then corrected (a missing stored value is rejected) and only that case was run again: Haiku answered exactly No findings. Counted as 2 of 3 on the first run, 3 of 3 after the corrected input."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The first clean input compared the returned state with the stored one without rejecting a missing value, which is what Haiku pointed out; the input was corrected and that one case was run again once on both models (both answered No findings.); the skill rules were not changed. Facts come from RFC 9700, RFC 7636 and RFC 6749, read on 26 October 2026; the rule that a state check is needed even with PKCE is the skill's own stricter policy. There are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":7202,"sha256":"0f0e2ba1cc8490fc47e50536ffcd6179cae69add11dc477fee77cfadf5064484","outline":["What the standards say, as published on 26 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"OAuth Redirect Flow Review for Login Code","seo_description":"Reviews one OAuth or OIDC sign-in flow for unchecked state, missing PKCE, loose redirect matching and tokens in URLs. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-26","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-26\n\nFirst release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n\nAfter the first runs: the clean test input was corrected (it did not reject a missing stored state) and that case was run again on both models; the skill rules are unchanged.\n"}]}