Configuration: OAuth Grant Misconfiguration¶

Identifier: oauth_grant_misconfiguration

Scanner(s) Support¶

Description¶

OAuth grant misconfiguration occurs when an OAuth client or authorization server enables grant types, token exchange paths, or client trust settings that do not match the intended security model.

How we test: We exercise OAuth grant flows and token exchange behavior to detect overly permissive grant types, unexpected grant downgrades, or authorization responses accepted outside the intended client and redirect context.

References:

• https://datatracker.ietf.org/doc/html/rfc6749
• https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  oauth_grant_misconfiguration:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.