OAuth 2.0 and OpenID Connect in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding OAuth 2.0 Grant Types

Which OAuth 2.0 grant type is best suited for a mobile application that cannot securely store client secrets?

A Resource Owner Password Credentials Grant

B Client Credentials Grant

C Authorization Code Grant with PKCE

D Implicit Grant

💡 Hint

Consider which grant type enhances security for public clients that cannot keep secrets.

The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is designed for public clients like mobile apps that cannot securely store secrets. It prevents interception attacks by adding an extra verification step.

📋 Factual

intermediate

OpenID Connect ID Token Contents

What key information does the ID Token in OpenID Connect always contain?

A Refresh token for session renewal

B Access permissions for APIs

C Client application's secret key

D User's identity claims and authentication event details

💡 Hint

Think about what OpenID Connect adds on top of OAuth 2.0 to identify the user.

The ID Token contains claims about the user's identity and details about the authentication event, such as when and how the user authenticated. It does not contain access permissions or secrets.

🔍 Analysis

advanced

Security Risks in OAuth 2.0 Flows

Which of the following scenarios best illustrates a security risk specific to the OAuth 2.0 Implicit Grant?

A Access tokens exposed in browser URL fragments, risking interception by malicious scripts

B Client credentials being leaked due to insecure storage on the server

C Refresh tokens being stolen from a secure backend database

D Authorization codes being intercepted during server-to-server communication

💡 Hint

Consider how tokens are delivered in the Implicit Grant and what risks that creates.

The Implicit Grant returns access tokens directly in the URL fragment, which can be exposed to browser history, logs, or malicious scripts, increasing the risk of token theft.

❓ Comparison

advanced

Comparing OAuth 2.0 and OpenID Connect

Which statement correctly distinguishes OpenID Connect from OAuth 2.0?

A OpenID Connect provides user authentication on top of OAuth 2.0's authorization framework

B OAuth 2.0 is used only for authentication, while OpenID Connect is for authorization

C OpenID Connect replaces OAuth 2.0 entirely with a new protocol

D OAuth 2.0 requires ID Tokens, but OpenID Connect does not

💡 Hint

Think about what each protocol is designed to do.

OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of a user. OpenID Connect builds on OAuth 2.0 by adding authentication, allowing clients to verify the user's identity.

❓ Reasoning

expert

Token Validation in OpenID Connect

After receiving an ID Token from an OpenID Connect provider, which step is essential to ensure the token's authenticity and prevent replay attacks?

A Check that the access token has not expired

B Verify the token's signature and check the nonce value matches the one sent in the authentication request

C Confirm the client secret matches the token issuer

D Ensure the refresh token is present and valid

💡 Hint

Focus on how to confirm the token was issued by the trusted provider and is linked to your request.

Verifying the ID Token's signature confirms it was issued by the trusted provider. Checking the nonce ensures the token corresponds to the authentication request, preventing replay attacks.

Practice

1. What is the main purpose of OAuth 2.0 in online applications?

easy

A. To allow apps to access user data without sharing passwords

B. To encrypt all user data during transmission

C. To replace passwords with biometric authentication

D. To store user passwords securely on servers

Solution

1. Step 1: Understand OAuth 2.0's role

   OAuth 2.0 is designed to let apps get permission to access user data without needing the user's password.

2. Step 2: Compare options to OAuth 2.0's purpose

   Storing passwords securely, encrypting data during transmission, and replacing passwords with biometrics describe other security features but not OAuth 2.0's main function.

3. Final Answer:

   To allow apps to access user data without sharing passwords -> Option A

4. Quick Check:

   OAuth 2.0 = Access without password [OK]

Hint: OAuth 2.0 = permission without password sharing [OK]

Common Mistakes:

• Confusing OAuth 2.0 with encryption protocols
• Thinking OAuth 2.0 replaces passwords
• Assuming OAuth 2.0 stores passwords

2. Which of the following is a correct OAuth 2.0 grant type?

easy

A. Authorization Code

B. Password Encryption

C. Token Hashing

D. User Authentication

Solution

1. Step 1: Identify OAuth 2.0 grant types

   OAuth 2.0 defines several grant types, including Authorization Code, Implicit, Client Credentials, and Resource Owner Password Credentials.

2. Step 2: Match options to known grant types

   Only 'Authorization Code' is a valid OAuth 2.0 grant type; others are incorrect terms.

3. Final Answer:

   Authorization Code -> Option A

4. Quick Check:

   Grant type = Authorization Code [OK]

Hint: Grant types include Authorization Code, not encryption terms [OK]

Common Mistakes:

• Confusing grant types with encryption methods
• Selecting made-up OAuth terms
• Mixing authentication with grant types

3. Given this OAuth 2.0 flow snippet:

1. User clicks login
2. App redirects to Authorization Server
3. User grants permission
4. Authorization Server sends code to App
5. App exchanges code for access token

What is the purpose of step 5?

medium

A. To get the user's password

B. To obtain an access token for API calls

C. To verify the user's identity directly

D. To log the user out of the app

Solution

1. Step 1: Understand step 5 in OAuth 2.0 flow

   Step 5 is where the app exchanges the authorization code for an access token from the authorization server.

2. Step 2: Identify the purpose of the access token

   The access token allows the app to make authorized API calls on behalf of the user without needing their password.

3. Final Answer:

   To obtain an access token for API calls -> Option B

4. Quick Check:

   Step 5 = Get access token [OK]

Hint: Code exchanged for access token to call APIs [OK]

Common Mistakes:

• Thinking step 5 gets the password
• Confusing access token with identity verification
• Assuming step 5 logs out the user

4. A developer uses OpenID Connect but forgets to validate the ID token signature. What is the main risk?

medium

A. User passwords will be exposed

B. The app will crash immediately

C. The app might accept fake user identities

D. The access token will expire too soon

Solution

1. Step 1: Understand ID token validation

   Validating the ID token signature ensures the token is from a trusted source and not tampered with.

2. Step 2: Identify risk of skipping validation

   If validation is skipped, attackers could send fake tokens, letting unauthorized users impersonate others.

3. Final Answer:

   The app might accept fake user identities -> Option C

4. Quick Check:

   ID token validation prevents fake identities [OK]

Hint: Always validate ID token signature to trust identity [OK]

Common Mistakes:

• Assuming app crashes without validation
• Confusing token validation with password exposure
• Thinking token expiration is affected

5. An app uses OAuth 2.0 with OpenID Connect to authenticate users. It wants to get the user's email and profile info securely. Which token should the app request and verify?

hard

A. Refresh token only

B. ID token only

C. Access token only

D. Both access token and ID token

Solution

1. Step 1: Understand token roles in OpenID Connect

   The ID token proves the user's identity and contains profile info. The access token allows access to user data APIs.

2. Step 2: Determine which tokens to use for email and profile

   The app should verify the ID token for identity and use the access token to request additional user info securely.

3. Final Answer:

   Both access token and ID token -> Option D

4. Quick Check:

   ID token + access token = secure user info [OK]

Hint: Use ID token for identity, access token for data [OK]

Common Mistakes:

• Using only access token and ignoring ID token
• Using only ID token without access token
• Confusing refresh token with identity info