invalid_grant security auth_error ai_generated true

OAuth2授权码重用检测到：同一授权码被多次使用

OAuth2 authorization code reuse detected: same authorization code used more than once

ID: security/oauth2-authorization-code-reuse-detection

其他格式: JSON · Markdown 中文 · English
90%修复率
88%置信度
1证据数
2023-11-20首次发现

版本兼容性

版本状态引入弃用备注
Spring Security OAuth2 2.5.0 active — — —
Keycloak 21.0.0 active — — —
Okta 2024.02.0 active — — —

根因分析

授权服务器未能正确标记授权码在首次使用后已消耗，允许攻击者重放之前截获的授权码以获取新的访问令牌。

English

The authorization server fails to properly mark authorization codes as consumed after first use, allowing an attacker to replay a previously intercepted code to obtain a new access token.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc6749#section-10.5

解决方案

  1. Ensure the authorization server marks the code as consumed atomically upon first use. For example, in a database-backed implementation, use a transaction: UPDATE auth_codes SET consumed=true WHERE code=? AND consumed=false. If affected rows is 0, reject the request.
  2. Implement a one-time use token pattern: after issuing the access token, immediately invalidate the authorization code from the store (e.g., Redis: DEL auth_code:<code>).
  3. Add a nonce or state parameter that must be unique per authorization request and validated during token exchange, preventing replay even if the code is intercepted.

无效尝试

常见但无效的做法:

  1. 80% 失败

    Longer expiration times actually increase the window for replay attacks, making the problem worse.

  2. 50% 失败

    Authorization codes are randomly generated and not meant to be guessed; the issue is replay, not brute force.

  3. 70% 失败

    Manual review is not scalable and cannot prevent real-time attacks; automated detection must be implemented.