RatCTF

🧪 Labs › Authentication

OAuth & Token Flows

Severity: High
Illustration for OAuth & Token Flows

The login dance has several moving parts — and skipping a check in any of them breaks it.

What it is

OAuth delegates login to a provider and hands the app a token or code. Its security depends on the app validating every step: the redirect_uri, the state parameter, the token's audience and issuer, and that a code is used once by the party it was issued to.

Common failures: a loose redirect_uri that lets a code leak to an attacker, a missing state check enabling login CSRF, accepting a token meant for a different client, or trusting identity claims the provider didn't actually assert.

Any of these can let an attacker take over accounts.

How to approach it

  • Trace the whole flow and note every value the app must validate — redirect_uri, state, the code/token, the claims.
  • Test what happens when you alter or omit each one.
  • Look at where a code or token is handled and whether its binding (client, audience, single-use) is enforced.
  • Reason from a skipped check to who could abuse it and how.

Your task

Find the step in the login flow that isn't properly validated and use it to authenticate as another user.

▶ Access the lab

Opens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.

How to prevent it

  • Exact-match redirect_uris; enforce state; validate token audience, issuer, and expiry.
  • Bind authorization codes to the client and make them single-use.
  • Never trust identity claims you didn't verify against the provider.

More Authentication labs

← All labs