The insecurity of OAuth 2.0 in frontends
summary
Claim: OAuth 2.0 flows run entirely in the browser are fundamentally insecure. Demonstrations build a toy restaurant app, a malicious server and an attack.js payload that first exfiltrates tokens from storage, then performs a silent iframe auth to get independent refresh/access tokens, and finally shows a service worker unregister bypass that defeats in-browser mitigations. Refresh token rotation is sidestepped by stealing a refresh token and resuming its chain while the client is offline. Practical fix is a tiny Backend-for-Frontend proxy that holds confidential client auth and prevents token misuse.
AI-written summary · about
chapters (8)
- 0:00OAuth 2.0 insecurity in frontends
- 2:29OAuth 2.0 for browsers
- 14:20Token exfiltration threat
- 21:03Refresh token rotation limits
- 28:48Malicious JS bypassing OAuth
- 37:39Browser-only OAuth flaws
- 44:41How a Backend for Frontend (BFF) solves the problem
- 53:22Q&A
related talks
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security
53mOAuth2/OIDC security weaknesses and pitfalls
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
47mTop X OAuth 2 Hacks
20mOAuth 2: A closer look
29mToken Security in Single Page Applications
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
27mMastering Secure Single Page Apps & APIs