A few important facts regarding OAuth security

  • OAuth without SSL is a Bad Idea™ and it’s strongly recommended to use
    SSL for all interactions both with your API as well as for setting up tokens. An example of when it’s especially bad is when sending POST requests with form data, this data is not accounted for in the OAuth signature and a successfull man-in-the-middle attacker could swap your form data (or files) to whatever he pleases without invalidating the signature. This is an even bigger issue if you fail to check nonce/timestamp pairs for each request, allowing an attacker who intercept your request to replay it later, overriding your initial request. Server defaults to fail all requests which are not made over HTTPS, you can explicitly disable this using the enforce_ssl property.
  • Tokens must be random, OAuthLib provides a method for generating
    secure tokens and it’s packed into oauthlib.common.generate_token, use it. If you decide to roll your own, use secrets.SystemRandom for Python 3.6 and later. The secrets module is designed for generating cryptographically strong random numbers. For earlier versions of Python, use random.SystemRandom which is based on os.urandom rather than the default random based on the effecient but not truly random Mersenne Twister. Predictable tokens allow attackers to bypass virtually all defences OAuth provides.
  • Timing attacks are real and more than possible if you host your
    application inside a shared datacenter. Ensure all validate_ methods execute in near constant time no matter which input is given. This will be covered in more detail later. Failing to account for timing attacks could enable attackers to enumerate tokens and successfully guess HMAC secrets. Note that RSA keys are protected through RSA blinding and are not at risk.
  • Nonce and timestamps must be checked, do not ignore this as it’s a
    simple and effective way to prevent replay attacks. Failing this allows online bruteforcing of secrets which is not something you want.
  • Whitelisting is your friend and effectively eliminates SQL injection
    and other nasty attacks on your precious data. More details on this in the check_ methods.
  • Require all callback URIs to be registered before use. OAuth providers
    are in the unique position of being able to restrict which URIs may be submitted, making validation simple and safe. This registration should be done in your Application management interface.