OAuth 2.0

API Securityadvanced

// Definition

An open delegation protocol that lets users grant third-party applications scoped access to their resources without sharing their password. OAuth 2.0 defines four grant flows — Authorization Code (web apps), Client Credentials (server-to-server), Device Code (CLI tools / TVs), and PKCE (mobile apps). QA engineers test OAuth flows by validating token exchange, scope enforcement, refresh token behaviour, and failure modes like expired tokens, insufficient scopes, and revoked access.

// Why it matters

OAuth lets an app act on a user's behalf without their password, via scoped, expiring tokens. QA tests the boundaries: that a token only grants its granted scopes, that it expires, that the redirect/callback can't be hijacked, and that revocation actually revokes.

// How to test

// A token scoped to read:profile must NOT perform a write
cy.request({
  method: 'DELETE',
  url: '/api/posts/55',
  headers: { Authorization: `Bearer ${readOnlyToken}` },
  failOnStatusCode: false,
}).its('status').should('eq', 403) // scope enforced server-side

// Expired token is rejected
cy.request({ url: '/api/me', headers: { Authorization: `Bearer ${expiredToken}` }, failOnStatusCode: false })
  .its('status').should('eq', 401)

// Common mistakes

  • Trusting the scope claim client-side but not enforcing it on the server
  • Loose redirect_uri matching (opens token theft via open redirect)
  • Treating OAuth (authorization) as if it proved identity (that's OIDC's job)

// Related terms