Identity Investigation Playbook

| Parameter | Type | Required | Description | |---|---|---:|---| | response_type | string | Yes | Must be code; reject implicit token delivery | | client_id | string | Yes | Registered OAuth client identifier | | redirect_uri | URI | Yes | Must exactly match the registered URI, including scheme, host, path, and port | | scope | string | Yes | Requested permissions; investigate unexpected privileged scopes | | state | string | Yes | Unpredictable request correlation value; prevents login-CSRF and response mix-up | | code_challenge | string | Yes | PKCE challenge derived from the verifier | | code_challenge_method | string | Yes | Use S256; reject plain | | code | string | Yes at token exchange | Short-lived, single-use authorization code | | code_verifier | string | Yes with PKCE | Secret value proving possession of the original client session |

Code Example

`bash

Authorization request: exact redirect URI and PKCE are mandatory. AUTH_URL="https://idp.example.com/authorize" curl -G "$AUTH_URL" \ --data-urlencode "response_type=code" \ --data-urlencode "client_id=investigation-console" \ --data-urlencode "redirect_uri=https://console.example.com/oauth/callback" \ --data-urlencode "scope=openid profile email" \ --data-urlencode "state=$(openssl rand -hex 32)" \ --data-urlencode "code_challenge=BASE64URL_SHA256_VERIFIER" \ --data-urlencode "code_challenge_method=S256"

Exchange the captured code only at the registered token endpoint. curl -sS -X POST https://idp.example.com/oauth/token \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=authorization_code' \ --data-urlencode 'client_id=investigation-console' \ --data-urlencode 'redirect_uri=https://console.example.com/oauth/callback' \ --data-urlencode 'code=AUTHORIZATION_CODE' \ --data-urlencode 'code_verifier=ORIGINAL_VERIFIER' `

For an incident, compare authorization and token-exchange timestamps, source IPs, user agents, client IDs, and redirect URIs. A code redeemed from a different network or device within its validity window is a high-value correlation.

Response Format

json { "access_token": "redacted", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "redacted", "scope": "openid profile email" }

access_token authorizes API calls. refresh_token may preserve access after the original code expires. expires_in is the lifetime in seconds. Do not place tokens in URLs, browser history, referrer headers, or incident tickets.

Notes & Best Practices

• Reject redirect URI prefixes, wildcards, user-controlled subdomains, and HTTP except for controlled local development. Exact matching prevents https://console.example.com.attacker.example abuse. - Authorization codes should be single-use and short-lived, commonly 60-120 seconds. Log failed reuse, redirect mismatch, PKCE failure, and client mismatch events. - In the Token Trail Map, connect state, code ID, client ID, redirect URI, token issuance event, and refresh-token activity. Revoke refresh tokens and sessions, then preserve the related logs as audit evidence. - Decision tree: If the redirect URI differs, classify as registration or validation abuse. If it matches but the code was redeemed elsewhere, investigate interception or callback compromise. If PKCE failed open, treat the code as potentially replayable and review all tokens issued from that client.

End of chapter one. 39 more chapters and about 22,472 words in the full book.