Security Best Practices
OAuth 2.0 authentication and authorization for the Oten ecosytem.
Last updated
OAuth 2.0 authentication and authorization for the Oten ecosytem.
Last updated
Production: Must use https:// for all redirect URIs
Development: Can use http://localhost only
Use TLS 1.2 or higher
The state parameter prevents CSRF attacks.
Implementation:
Generate random state value
Store in session
Include in authorization URL
Validate on callback
Requirements:
Minimum 128 bits entropy
Cryptographically random
Single-use
Time-limited (5-10 minutes)
PKCE is mandatory for:
Single Page Applications (SPAs)
Mobile applications
Any public client
Generate code verifier (43-128 random characters)
Create code challenge (SHA-256 hash of verifier)
Send challenge with authorization request
Send verifier with token exchange
Use short-lived access tokens (15-60 min)
Implement refresh token rotation
Always use HTTPS
Include tokens in Authorization header
Never log tokens
Regular: Every 90 days
Incident: Immediately upon compromise
Automated: Use secret rotation tools
Failed authentication attempts
Unusual token usage patterns
Scope escalation attempts
Geographic anomalies
Rapid token refresh
Detect and assess
Revoke compromised credentials
Investigate logs
Rotate secrets
Notify affected users
Document incident
Implement data minimization
Provide clear privacy policies
Enable user consent management
Support data deletion requests
Maintain audit logs
GDPR (EU) - Data protection
CCPA (California) - Consumer privacy
HIPAA (Healthcare) - Health information
PCI DSS (Payment) - Card data security
Never:
Development
Commit to version control
- Decode JWT tokens
- Security scanner
Embed in client-side code
Log in application logs
Share via email/chat
Store in plain text
Web App
Server-side session
Browser localStorage
SPA
Memory only
localStorage/sessionStorage
iOS
Keychain
UserDefaults
Android
EncryptedSharedPreferences
SharedPreferences
Environment variables (.env)
Production
Secret management (Vault, AWS secrets manager)