Apisecure, 14 & 15 March 2023 - Pieter Philippaerts, Research Manager at KU Leuven .
summary
An open source automated tester runs 113 test cases derived from 10 RFCs to map OAuth 2.0 server behavior, then projects results onto the RFC 6819 threat model. The team scans 100 public deployments and finds surprising gaps: one in three failed security requirements on average, 20% of mandatory measures missing, PKCE absent or broken on ~79% of code‑flow servers, and many long‑lived tokens. The tool produces site‑specific reports and proof‑of‑concept exploits with low false positive/negative rates.
AI-written summary · about
chapters (15)
- 0:00OAuth security research intro
- 1:06OAuth compliance tool intro
- 8:08How the OAuth tool works
- 16:35Live OAuth tool demo
- 22:13Interpreting OAuth test results
- 26:04Analysis of 100 OAuth implementations
- 32:30Why OAuth compliance is low
- 39:35Key OAuth research lessons
- 43:26Conclusion and tool availability
- 44:07Q&A: Tool limitations
- 46:37Q&A: Supported OAuth flows
- 48:22Q&A: Top OAuth threats
- 52:38Q&A: OpenID Connect differences
- 55:12Q&A: Speaker background
- 56:58Follow-up research
related talks
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
27mCommon Application Security Mistakes that Enable Automated Attacks
44mShift-Left-Security with the Security Test Pyramid
46mInsecure Expectations
27mHow to Start Security Testing Without Fear
26mOffensive API Penetration Testing
15mJumpstart Security & Penetration Testing APIs
44mSecurity Research with Open Source Software: Vol. Omega