OAuth Mistakes in Production
This post is a checklist disguised as war stories
Every item below appears in real audits. OAuth did not fail — configuration and application code did.
1. Redirect URI laxity
Mistake: Register https:
mnafshin.info4 min read