OAuth Hardening

Overview

OAuth sign-in is a security-critical integration boundary, not just a faster login button. Harden the flow around provider trust, redirect handling, token scope, callback validation, and account-linking decisions so identity integration does not become the weakest part of the system.

Follow This Workflow

1. Define the trust model

• Identify which providers are trusted and what identity guarantees they actually provide.
• Distinguish authentication, delegated access, and account-linking use cases.
• Define which provider claims are trusted, mapped, or ignored internally.

2. Constrain the authorization flow