oauth2-flows-and-pitfalls

仓库创建 2026年7月26日最近提交 18 小时前SkillHot 收录 4 小时前

▸ 精选理由

适合实现登录/授权时防止重定向、state、PKCE 等坑。

这个 Skill 做什么

帮助选择及复核 OAuth2 授权流并避免常见安全失误。

在选用或审查 OAuth2 授权流时，帮你挑对授予类型并避免常见安全陷阱，比如 redirect、state 或 PKCE 配置错误。适合设计需要委托访问的集成场景，或复核已有实现是否安全。特别强调几个能导致账户被接管的细节，提醒按客户端类型选对 grant 并补齐必要保护。

▸ 展开 SKILL.md 英文原文

Use when choosing or reviewing an OAuth2 flow — picking the right grant for the client type and avoiding the redirect, state, and PKCE mistakes that break it.

研究检索OAuth2授权流安全配置通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/01-oauth2-flows-and-pitfalls/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/01-oauth2-flows-and-pitfalls/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

OAuth2 is an authorisation framework, not a drop-in login, and most of its security problems come from picking the wrong flow or skipping one of its safety parameters. This skill covers which grant fits which client, and the handful of checks that separate a safe integration from an account-takeover waiting to happen.

## When to use it

Designing an integration that delegates access, reviewing one someone else built, or testing an OAuth deployment during an assessment. If you see `response_type`, `redirect_uri`, `code`, or `state` in the traffic, this is your skill.

## Choosing the grant

- **Authorization Code + PKCE** — the default for essentially everything today: web apps,

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有