# OAuth Redirect Flow Review OAuth Redirect Flow Review is a tested SKILL.md that reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/oauth-redirect-flow-review - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review ## Use it when Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow or an access token carried in a URL. It leaves out the safe look-alikes, such as a state kept in a cookie and compared, an exact redirect match, a server-side client with a secret, and a token sent in a header. Use to review a login integration, to audit a single-page app before launch, or to check a gateway that handles redirects. ## Not for Token signature checks, session storage after login, the setup of an identity provider, SAML and password forms. It reads the pasted code of one sign-in flow and judges only what is written in it. ## Tested, honestly Tested 2026-10-26. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 3 cases, read by hand. On the gateway it found the state cookie that is set and never compared and the redirect matched by prefix, and left out the missing PKCE of a client that holds a secret. On the browser orders app it found the absent PKCE challenge and the access token in a query string, and left out the state kept in sessionStorage and the exact redirect constant. On the clean billing app it answered exactly No findings. - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on both planted files, with sound fixes, keeping the confidential client, the sessionStorage state and the exact redirect out of its list. On the first run of the clean billing app it added one STATE-UNCHECKED line, because a returned state and a stored value that are both null would compare equal, and that edge really was in our clean input. The input was then corrected (a missing stored value is rejected) and only that case was run again: Haiku answered exactly No findings. Counted as 2 of 3 on the first run, 3 of 3 after the corrected input. Note: Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The first clean input compared the returned state with the stored one without rejecting a missing value, which is what Haiku pointed out; the input was corrected and that one case was run again once on both models (both answered No findings.); the skill rules were not changed. Facts come from RFC 9700, RFC 7636 and RFC 6749, read on 26 October 2026; the rule that a state check is needed even with PKCE is the skill's own stricter policy. There are no owner-measured facts. Full summary: https://aiskills402.com/skills/oauth-redirect-flow-review/tests ## Example ### English (claude-sonnet-5-5) Before: > const express = require('express'); const crypto = require('node:crypto'); const app = express(); const AUTH_URL = 'https://id.example.com/authorize'; const TOKEN_URL = 'https://id.example.com/token'; const REGISTERED = [ 'https://app.example.com/callback', 'https://admin.example.com/callback', ]; app.get('/login', (req, res) => {… After: > STATE-UNCHECKED — `/callback`, never reads `req.query.state` or the `oauth_state` cookie set in `/login` — an attacker can send the victim's browser a callback carrying the attacker's code and complete a login as the wrong account — read the cookie in `/callback`, compare it to `req.query.state`, reject on mismatch, then clear the cookie… ## What is in the file - What the standards say, as published on 26 October 2026 - The answer - The codes - Rules - Work in this order - Short example ## Languages English ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 7.0 KB (7202 bytes) - SHA-256: 0f0e2ba1cc8490fc47e50536ffcd6179cae69add11dc477fee77cfadf5064484 - Updated: 2026-10-26 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-26) First release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description. Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand. After the first runs: the clean test input was corrected (it did not reject a missing stored state) and that case was run again on both models; the skill rules are unchanged. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Server-side client with a secret and no PKCE: reported? No. The line is for clients that cannot keep a secret, such as browser or mobile apps. A web server that authenticates to the token endpoint with its own secret is left alone, as the best-practice document asks PKCE of public clients. ### State saved in sessionStorage: reported? No. A saved per-session value that is compared with the returned one before the code is used is the accepted form; the place can be a cookie, the server session or sessionStorage. A state that is set and never compared does earn a line. ### Which flows went into the test? Three code samples we wrote ourselves. First, an Express gateway that sets a state cookie but never reads it back and matches redirects by prefix. Second, a browser app with no PKCE that puts its token in a query string. Third, a correct browser app. Each model was given every sample one time. ### What does a sound flow return? A single short sentence, No findings., and nothing beside it. Each real mistake is reported on its own line giving code, function, damage and repair, and the parts that were read and judged fine stay unmentioned. ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.