{"slug":"oauth-redirect-flow-review-b028bfdb","name":"OAuth Redirect Flow Review","summary":"OAuth Redirect Flow Review — Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow …","status":"live","headings":[],"indexable":true,"listed_since":"2026-10-27T11:36:21.930074Z","sources":[{"source":"x402_bazaar","external_id":"https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","owner_address":"0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68","seen_at":"2026-11-10T10:14:53.837732Z","removed_at":null}],"endpoints":[{"url":"https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","host":"api.aiskills402.com","protocol":"x402","state":"live","last_probe_at":"2026-11-09T04:57:11.754389Z","last_ok_at":"2026-11-09T04:57:11.754389Z","tools_count":null,"tools_changed_at":null,"uptime_24h":null,"uptime_30d":1.0}],"also_listed_as":[{"slug":"api-aiskills402-com-62d86cc3","name":"api.aiskills402.com"}],"payment_options":[{"endpoint_url":"https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","network":"eip155:8453","scheme":"exact","rail":"exact","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","coin":"USDC","asset_label":"USD Coin","amount":"10000","pay_to":"0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68","observed_at":"2026-11-09T04:57:11.754389Z"}],"usage":{"source":"x402_bazaar","unique_payers_30d":1,"paid_calls_30d":2,"last_paid_at":"2026-11-03T03:05:07.503Z","reported_at":"2026-11-10T10:14:53.837732Z"},"assessment":{"method":"2026.10.2","checks":[{"id":"answers","state":"pass","reason":"Answered a check 19 hours ago."},{"id":"owner","state":"fail","reason":"No one has proven control of its domain or of the wallet it is paid at."},{"id":"track_record","state":"fail","reason":"Listed for 13 days; 30 are needed."},{"id":"real_customers","state":"fail","reason":"1 different wallets paid it in 30 days, as the x402 Bazaar reports (not yet counted by addrbook); 10 are needed."},{"id":"clean_scan","state":"not_applicable","reason":"Not an MCP server."}],"passed":1,"applicable":4,"contradicted":false,"computed_at":"2026-11-10T00:34:01.921417Z"},"identity":{"endpoint_domains":["aiskills402.com"],"proven_domains":[],"proven_wallets":[],"namesakes":[],"namesake_count":0,"identity_checks":[],"wallet_attestations":[],"human_backings":[]},"replies":[],"customers":null,"scan":null,"notice":"Not affiliated with addrbook — claim or request removal."}