Remove ambiguity from redirect flows
Authorization servers should compare redirect URIs against registered values with exact string matching. Wildcards, partial comparisons, and open redirectors create room for an authorization code to reach the wrong destination.
Authorization Code Flow with PKCE is no longer a mobile-only recommendation. A transaction-specific verifier binds the start and finish of the flow and protects both public and confidential clients from code injection and misuse.
Keep every token narrow
An access token should carry the smallest useful privilege and be restricted to its intended resource server. A resource server must verify audience as well as signature; a correctly signed token for another service is still the wrong token.
Public clients should use sender-constrained refresh tokens or rotate them after each use. Reuse of an older token then becomes a compromise signal instead of an ordinary request.
- Never expose access tokens in browser URLs.
- Publish authorization-server metadata and consume it on clients.
- Validate issuer, audience, lifetime, and an explicit algorithm allowlist.
- Retire implicit and password-style grants rather than preserving them indefinitely.
Migrate without a big bang
Inventory real clients and redirect URIs first. Add telemetry for violations, roll out PKCE in a compatible phase, and then make it mandatory. Give legacy flows a measured retirement date and an owner.
A strong OAuth configuration is intentionally boring: few flows, strict input checks, short-lived credentials, and predictable rotation. That predictability is a security feature.