OAuth 2.0 and OpenID Connect in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding OAuth 2.0 Grant Types

Which OAuth 2.0 grant type is best suited for a mobile application that cannot securely store client secrets?

A Resource Owner Password Credentials Grant

B Client Credentials Grant

C Authorization Code Grant with PKCE

D Implicit Grant

💡 Hint

Consider which grant type enhances security for public clients that cannot keep secrets.

The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is designed for public clients like mobile apps that cannot securely store secrets. It prevents interception attacks by adding an extra verification step.

📋 Factual

intermediate

OpenID Connect ID Token Contents

What key information does the ID Token in OpenID Connect always contain?

A Refresh token for session renewal

B Access permissions for APIs

C Client application's secret key

D User's identity claims and authentication event details

💡 Hint

Think about what OpenID Connect adds on top of OAuth 2.0 to identify the user.

The ID Token contains claims about the user's identity and details about the authentication event, such as when and how the user authenticated. It does not contain access permissions or secrets.

🔍 Analysis

advanced

Security Risks in OAuth 2.0 Flows

Which of the following scenarios best illustrates a security risk specific to the OAuth 2.0 Implicit Grant?

A Access tokens exposed in browser URL fragments, risking interception by malicious scripts

B Client credentials being leaked due to insecure storage on the server

C Refresh tokens being stolen from a secure backend database

D Authorization codes being intercepted during server-to-server communication

💡 Hint

Consider how tokens are delivered in the Implicit Grant and what risks that creates.

The Implicit Grant returns access tokens directly in the URL fragment, which can be exposed to browser history, logs, or malicious scripts, increasing the risk of token theft.

❓ Comparison

advanced

Comparing OAuth 2.0 and OpenID Connect

Which statement correctly distinguishes OpenID Connect from OAuth 2.0?

A OpenID Connect provides user authentication on top of OAuth 2.0's authorization framework

B OAuth 2.0 is used only for authentication, while OpenID Connect is for authorization

C OpenID Connect replaces OAuth 2.0 entirely with a new protocol

D OAuth 2.0 requires ID Tokens, but OpenID Connect does not

💡 Hint

Think about what each protocol is designed to do.

OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of a user. OpenID Connect builds on OAuth 2.0 by adding authentication, allowing clients to verify the user's identity.

❓ Reasoning

expert

Token Validation in OpenID Connect

After receiving an ID Token from an OpenID Connect provider, which step is essential to ensure the token's authenticity and prevent replay attacks?

A Check that the access token has not expired

B Verify the token's signature and check the nonce value matches the one sent in the authentication request

C Confirm the client secret matches the token issuer

D Ensure the refresh token is present and valid

💡 Hint

Focus on how to confirm the token was issued by the trusted provider and is linked to your request.

Verifying the ID Token's signature confirms it was issued by the trusted provider. Checking the nonce ensures the token corresponds to the authentication request, preventing replay attacks.