# OAuth Attack Matrix — Phase G-4

**Commit:** `02a04df2719094e28db97575b9fbecb940b6ead3`  
**Date:** 2026-08-18

## Legend
OK / WARN / GAP / FAIL

---

## OAuth State / PKCE

| # | Attack | Result | Grade |
|---|--------|--------|-------|
| 1 | missing state | ValidationError | OK |
| 2 | unknown state | Unauthorized | OK |
| 3 | expired state | Unauthorized | OK |
| 4 | reused state | Unauthorized (deleted) | OK |
| 5 | concurrent same state | possible double consume | **WARN/GAP** |
| 6 | foreign browser state | fail | OK |
| 7 | error=access_denied | state consumed | OK |
| 8 | missing code | ValidationError | OK |
| 9 | wrong codeVerifier | VK rejects | OK |
| 10 | cross-tx verifier | bound by state | OK |

## Redirect / Host

| # | Attack | Result | Grade |
|---|--------|--------|-------|
| 1 | https://evil.com | → `/` | OK |
| 2 | //evil.com | → `/` | OK |
| 3 | /\evil.com /\\evil | → `/` | OK |
| 4 | javascript: / data: | → `/` | OK |
| 5 | Host poisoning, VK_REDIRECT_URI unset | Location/redirect_uri risk | **WARN** |
| 6 | VK_REDIRECT_URI set | fixed URI | OK |

## Session / Cookie

| # | Check | Result | Grade |
|---|-------|--------|-------|
| 1 | CSPRNG session id | randomBytes(32) | OK |
| 2 | Session fixation | new id always | OK |
| 3 | HttpOnly Secure SameSite | yes (prod Secure) | OK |
| 4 | Token in cookie | no | OK |
| 5 | Memory multi-instance | FATAL if MULTI_INSTANCE | OK (guard) / WARN (limit) |

## CSRF

| # | Attack | Result | Grade |
|---|--------|--------|-------|
| 1 | cross-site Sec-Fetch-Site | Forbidden | OK |
| 2 | evil Origin | Forbidden | OK |
| 3 | missing Origin/Referer prod | Forbidden | OK |
| 4 | X-Forwarded-Host trust | depends on edge | **WARN** |

## Ownership

| # | Attack | Result | Grade |
|---|--------|--------|-------|
| 1 | B accesses A’s giveaway | 403 | OK |
| 2 | anonymous mutation | 401 | OK |
| 3 | organizerId null | Forbidden | OK |
| 4 | delete User with giveaways | Restrict FK | OK |

## TokenVault

| # | Attack | Result | Grade |
|---|--------|--------|-------|
| 1 | no/short key in prod | FATAL | OK |
| 2 | tampered IV/tag/ciphertext | decrypt fail | OK |
| 3 | marker token in API/errors | not present by design | OK |

## Endpoint contract

| Claim | Verdict |
|-------|---------|
| id.vk.com/auth vs id.vk.ru/authorize | PARTIALLY VERIFIED |
| oauth2/auth token | PARTIALLY VERIFIED |
| PKCE S256 | VERIFIED |
| device_id | UNVERIFIED (often required) |
| scope commas vs spaces | WARN |

---

## Summary grades

| Area | Grade |
|------|-------|
| OAuth State/PKCE | **PASS WITH WARNINGS** |
| OAuth endpoint correctness | **PASS WITH WARNINGS** |
| Session | **PASS WITH WARNINGS** |
| CSRF | **PASS WITH WARNINGS** |
| Ownership/AuthZ | **PASS** |
| TokenVault | **PASS** |
| Redirect safety | **PASS WITH WARNINGS** |
| Privacy | **PASS WITH WARNINGS** |
| **Overall** | **PASS WITH FIXES** |

## Phase 2.3

**YES** — with mandatory `VK_REDIRECT_URI` + encryption key, single-instance or shared session/OAuth store, and planned fix for concurrent state consume + live VK ID parameter check (`device_id`, authorize path).