Why OAuth Is Insecure in Frontend Apps (And How to Fix It)
OAuth and OpenID Connect are widely used in frontend apps, but are they secure? In this talk, security expert Philippe De Ryck breaks down why browser-based OAuth flows are vulnerable to token theft via cross-site scripting and malicious JavaScript.
Whether you’re using React, Angular, or Vue, this session helps you rethink frontend OAuth security and implement stronger protection.
📌 Get Started with FusionAuth for free: https://fusionauth.io/docs/get-started
Timestamps:
00:00 – Introduction
00:49 – History of OAuth 2.0
02:06 – Frontend Security & OAuth Challenges
02:21 – Malicious JavaScript Overview
03:08 – How XSS Enables Token Theft
05:19 – What Malicious JavaScript Means for OAuth Tokens
06:01 – Token Exfiltration Walkthrough
09:00 – Refresh Tokens & Rotation Explained
13:06 – Attack: Refresh Token Used Once
16:21 – Demo: Sidestepping Refresh Token Rotation
22:22 – Token Exfiltration is Irrelevant for Next Attack
24:45 – Demo: Requesting a Fresh Set of Tokens
29:05 – You Can’t Fully Secure Browser-Only OAuth Flows
31:42 – First-Party Architecture Pattern with HTTP-Only Cookies
36:06 – BFF Architecture Walkthrough & Security Benefits
🎯 Get a Demo: https://fusionauth.io/contact
🔔 Subscribe for more in-depth content on OAuth, OpenID Connect, and app security best practices.