Question

A development team is integrating a new cloud-hosted analytics application with the company's identity provider. Developers implemented OAuth 2.0 access tokens and use the presence of a valid access token to log the user in and populate their profile page. During a security review, the assessor flags this as an authentication design flaw. What is the MOST accurate reason the current approach is insecure, and what should the team adopt?

Accepted Answer

OAuth 2.0 access tokens are opaque authorization grants not proof of user authentication; the team should use OpenID Connect ID tokens to reliably establish and convey user identity

Answer

OAuth 2.0 is inherently insecure over the public internet; the team should replace it with SAML assertions transmitted over a dedicated VPN tunnel

Answer

Access tokens expire too quickly for login sessions; the team should use long-lived refresh tokens directly as the authentication credential

Answer

The flaw is that tokens are not encrypted at rest; the team should store access tokens in an HSM and treat token possession as valid authentication