OAuth 2.0 Flows Demystified

// Step 1: Generate PKCE challenge
import crypto from "crypto";
 
function generatePKCE() {
  const verifier = crypto.randomBytes(32).toString("base64url");
  const challenge = crypto
    .createHash("sha256")
    .update(verifier)
    .digest("base64url");
 
  return { verifier, challenge };
}
 
// Step 2: Redirect user to authorization server
function getAuthorizationUrl(pkce: { challenge: string }) {
  const params = new URLSearchParams({
    response_type: "code",
    client_id: process.env.OAUTH_CLIENT_ID!,
    redirect_uri: "https://myapp.com/callback",
    scope: "openid profile email",
    state: crypto.randomBytes(16).toString("hex"),
    code_challenge: pkce.challenge,
    code_challenge_method: "S256",
  });
 
  return `https://auth.provider.com/authorize?${params}`;
}

// Step 3: Exchange authorization code for tokens
async function exchangeCode(code: string, verifier: string) {
  const response = await fetch("https://auth.provider.com/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: "https://myapp.com/callback",
      client_id: process.env.OAUTH_CLIENT_ID!,
      code_verifier: verifier, // PKCE verification
    }),
  });
 
  return response.json();
  // { access_token: "...", refresh_token: "...", id_token: "...", expires_in: 3600 }
}

// ✅ Service-to-service authentication
async function getServiceToken() {
  const response = await fetch("https://auth.provider.com/token", {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      Authorization: `Basic ${Buffer.from(
        `${process.env.CLIENT_ID}:${process.env.CLIENT_SECRET}`,
      ).toString("base64")}`,
    },
    body: new URLSearchParams({
      grant_type: "client_credentials",
      scope: "api:read api:write",
    }),
  });
 
  return response.json();
}
 
// Cache the token until near expiry
let cachedToken: { token: string; expiresAt: number } | null = null;
 
async function getValidToken(): Promise<string> {
  if (cachedToken && cachedToken.expiresAt > Date.now() + 60000) {
    return cachedToken.token;
  }
 
  const data = await getServiceToken();
  cachedToken = {
    token: data.access_token,
    expiresAt: Date.now() + data.expires_in * 1000,
  };
 
  return cachedToken.token;
}

// ❌ Not validating the state parameter — CSRF vulnerability
app.get("/callback", async (req, res) => {
  const { code } = req.query;
  const tokens = await exchangeCode(code); // Missing state check!
});
 
// ✅ Always validate state
app.get("/callback", async (req, res) => {
  const { code, state } = req.query;
 
  const savedState = req.session.oauthState;
  if (!state || state !== savedState) {
    return res.status(403).json({ error: "Invalid state parameter" });
  }
 
  delete req.session.oauthState;
  const tokens = await exchangeCode(code, req.session.pkceVerifier);
});

// ❌ Not validating the ID token
const user = jwt.decode(tokens.id_token); // Decode without verify!
 
// ✅ Verify the ID token signature, issuer, and audience
const user = jwt.verify(tokens.id_token, publicKey, {
  issuer: "https://auth.provider.com",
  audience: process.env.OAUTH_CLIENT_ID,
  algorithms: ["RS256"],
});

// Access token: short-lived, used for API calls
// Refresh token: long-lived, used to get new access tokens
 
async function refreshAccessToken(refreshToken: string) {
  const response = await fetch("https://auth.provider.com/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: refreshToken,
      client_id: process.env.OAUTH_CLIENT_ID!,
    }),
  });
 
  if (!response.ok) {
    // Refresh token expired or revoked — user must re-authenticate
    throw new AuthenticationError("Session expired");
  }
 
  return response.json();
}