OAuth Redirect Flow Review: test results

Verdicts

Date

2026-10-26

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 3 cases, read by hand. On the gateway it found the state cookie that is set and never compared and the redirect matched by prefix, and left out the missing PKCE of a client that holds a secret. On the browser orders app it found the absent PKCE challenge and the access token in a query string, and left out the state kept in sessionStorage and the exact redirect constant. On the clean billing app it answered exactly No findings.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on both planted files, with sound fixes, keeping the confidential client, the sessionStorage state and the exact redirect out of its list. On the first run of the clean billing app it added one STATE-UNCHECKED line, because a returned state and a stored value that are both null would compare equal, and that edge really was in our clean input. The input was then corrected (a missing stored value is rejected) and only that case was run again: Haiku answered exactly No findings. Counted as 2 of 3 on the first run, 3 of 3 after the corrected input.

Note

Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The first clean input compared the returned state with the stored one without rejecting a missing value, which is what Haiku pointed out; the input was corrected and that one case was run again once on both models (both answered No findings.); the skill rules were not changed. Facts come from RFC 9700, RFC 7636 and RFC 6749, read on 26 October 2026; the rule that a state check is needed even with PKCE is the skill's own stricter policy. There are no owner-measured facts.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.