Add OAuth Security with AI Prompts

Implement OAuth login with proper CSRF protection.

Provider: Google/GitHub/Discord Framework: Next.js/Express

Authorization request must include:

1. state: cryptographically random value
2. Store state in session before redirect
3. Verify state matches on callback
4. Use state only once

Implementation:

1. Generate state: crypto.randomBytes(32).toString('hex')
2. Store in session: session.oauthState = state
3. Include in auth URL: &state={state}
4. On callback: verify req.query.state === session.oauthState
5. Delete state from session after verification

Reject callback if:

• State is missing
• State doesn't match session
• State was already used

Implement PKCE (Proof Key for Code Exchange) for OAuth.

PKCE prevents authorization code interception attacks.

Flow:

1. Generate code_verifier: random 43-128 character string
2. Create code_challenge: base64url(sha256(code_verifier))
3. Send code_challenge in authorization request
4. Send code_verifier in token exchange

Implementation:

• code_verifier = crypto.randomBytes(32).toString('base64url')
• code_challenge = base64url(sha256(code_verifier))

Authorization URL: &code_challenge={challenge} &code_challenge_method=S256

Token request: code_verifier={verifier}

Store code_verifier in session alongside state. Both must be present and valid on callback.

Handle OAuth tokens securely after authentication.

After token exchange, you receive:

• access_token: for API calls
• refresh_token: for getting new access tokens
• id_token: user identity (if OpenID Connect)

Storage rules:

1. Never expose tokens to client/frontend
2. Store encrypted in database or secure session
3. access_token: short-lived, can be in memory
4. refresh_token: encrypt at rest, secure storage

For server-side apps:

• Store tokens in encrypted session
• Use httpOnly cookies for session ID
• Refresh tokens before they expire

For SPAs (avoid if possible):

• Use BFF (Backend for Frontend) pattern
• Keep tokens server-side
• Don't store tokens in localStorage

Properly verify ID tokens from OAuth providers.

Never trust ID token claims without verification:

1. Verify signature using provider's public keys
2. Check iss (issuer) matches expected provider
3. Check aud (audience) matches your client ID
4. Check exp (expiration) is in the future
5. Check iat (issued at) is reasonable
6. For Google: check azp if multiple clients

Fetch provider's JWKS (JSON Web Key Set):

• Google: https://www.googleapis.com/oauth2/v3/certs
• Cache keys but refresh periodically

After verification:

• Extract sub (subject) as stable user ID
• email may not be verified - check email_verified claim
• Don't trust name/picture without sanitizing

Use libraries: jose, jsonwebtoken with verify options