What is OAuth?

In a typical OAuth flow, your app redirects the user to the identity provider (Google, GitHub, etc.). The user logs in there and approves specific permissions (scopes). The provider then redirects back to your app with an authorization code, which your server exchanges for an access token. This token lets your app access only the approved resources on behalf of the user.

Social login via OAuth dramatically reduces signup friction, which is critical for new products. However, AI tools often implement OAuth flows with subtle security gaps — missing state parameters (enabling CSRF attacks), storing tokens insecurely, or requesting overly broad permission scopes that erode user trust.

Missing the 'state' parameter which prevents CSRF attacks, storing access tokens in localStorage (vulnerable to XSS), not validating redirect URIs (open redirect attacks), requesting more permissions than needed, and failing to handle token refresh when access tokens expire.

Use established libraries like NextAuth.js or Passport.js rather than implementing OAuth from scratch. Always include and validate the state parameter. Store tokens in secure, httpOnly cookies — never in localStorage. Request only the minimum scopes needed. Implement token refresh logic. Register exact redirect URIs with your OAuth provider.