Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
If anyone can register an OAuth client, you must validate its metadata, get user consent, and warn about untrusted apps. Practical controls and tests.
The authorization server must demand a code_challenge, refuse the plain method, and check the code_verifier at the token endpoint. Config, code and a test plan.
Public clients cannot keep a secret, so a stolen refresh token is dangerous. Use sender-constrained tokens, or rotate with reuse detection. Code and tests inside.
Each OAuth client should be registered with only the grant types it uses. Implicit and password grants are out entirely. Here is how to configure and verify it.
Authorization codes should expire in at most 10 minutes for L1 and L2, and 1 minute for L3. Most servers choose far less. Set it, enforce it, test it.
An authorization code may be exchanged for tokens one time. A replay must fail and revoke whatever the first exchange issued. Here is how to build and test it.
At Level 3, shared client secrets are out. Use public-key client authentication that resists replay, such as private_key_jwt or mutual TLS.
For server-side clients at Level 3, make sure authorization_details comes from the client backend, using PAR or JAR, so the user cannot edit what is being authorized.
At Level 3, bearer tokens are not enough. Bind every access token to a key with DPoP or mutual TLS, and make resource servers check the binding.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
