Security Best Practices

# How state verification works internally
class OAuthState(models.Model):
    state = models.CharField(max_length=64, primary_key=True)
    provider = models.CharField(max_length=20)
    redirect_uri = models.URLField()
    expires_at = models.DateTimeField()
 
    @property
    def is_expired(self) -> bool:
        return timezone.now() > self.expires_at

# Shorter state timeout for higher security
github_oauth = GitHubOAuthConfig(
    # ...
    state_timeout_seconds=120,  # 2 minutes instead of default 5
)

// Simple but requires XSS protection
localStorage.setItem('access_token', tokens.access);
localStorage.setItem('refresh_token', tokens.refresh);

// Frontend: Let backend set cookies
const response = await fetch('/api/oauth/callback/', {
  method: 'POST',
  credentials: 'include',  // Important!
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ code, state, redirect_uri }),
});
 
// Backend sets httpOnly cookie in response
// No token handling needed in frontend

# Backend modification (in views/oauth.py)
response = Response(data)
response.set_cookie(
    'access_token',
    tokens['access'],
    httponly=True,
    secure=True,  # HTTPS only
    samesite='Lax',
    max_age=3600 * 24,  # 1 day
)
return response

async function refreshTokens(): Promise<boolean> {
  const refreshToken = localStorage.getItem('refresh_token');
  if (!refreshToken) return false;
 
  try {
    const response = await fetch(`${API_URL}/cfg/accounts/token/refresh/`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ refresh: refreshToken }),
    });
 
    if (!response.ok) {
      // Refresh token expired, logout user
      clearTokens();
      window.location.href = '/auth/login';
      return false;
    }
 
    const { access } = await response.json();
    localStorage.setItem('access_token', access);
    return true;
  } catch {
    return false;
  }
}

# Internal validation
def verify_state(cls, state: str, redirect_uri: str) -> Optional[OAuthState]:
    oauth_state = OAuthState.objects.get(state=state)
 
    # Verify redirect_uri matches what was stored
    if oauth_state.redirect_uri != redirect_uri:
        logger.warning("OAuth redirect_uri mismatch")
        return None
 
    return oauth_state

# In your config or settings
ALLOWED_OAUTH_REDIRECT_URIS = [
    "https://myapp.com/auth/callback",
    "https://www.myapp.com/auth/callback",
    # Development (remove in production)
    # "http://localhost:3000/auth/callback",
]

# In DjangoConfig
axes = AxesConfig(
    failure_limit=5,
    cooloff_time=1,  # 1 hour lockout
)

# In DRF throttle settings
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '10/minute',  # 10 OAuth attempts per minute
    }
}

# .env (gitignored!)
GITHUB_OAUTH__CLIENT_ID=your-client-id
GITHUB_OAUTH__CLIENT_SECRET=your-secret-key
 
# Rotate secrets regularly
# Use secret management in production (AWS Secrets Manager, Vault, etc.)

# Good: Minimal scopes
github_oauth = GitHubOAuthConfig(
    scope=["user:email", "read:user"],
)
 
# Avoid: Overly broad scopes
github_oauth = GitHubOAuthConfig(
    scope=["user", "repo", "admin:org"],  # Too much access!
)

# Option 1: Only link to verified emails
github_oauth = GitHubOAuthConfig(
    allow_account_linking=True,
    # Internal check: only link if user.email_verified is True
)
 
# Option 2: Disable auto-linking, require manual linking
github_oauth = GitHubOAuthConfig(
    allow_account_linking=False,
    auto_create_user=True,
    # Users must explicitly link accounts in settings
)

// Frontend: List user's OAuth connections
const connections = await fetch(`${API_URL}/cfg/accounts/oauth/connections/`, {
  headers: { 'Authorization': `Bearer ${accessToken}` },
});
 
// Frontend: Disconnect a provider
await fetch(`${API_URL}/cfg/accounts/oauth/disconnect/`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ provider: 'github' }),
});

# Django settings (auto-configured by Django-CFG in production)
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

# Get notified of OAuth events
telegram = TelegramConfig(
    bot_token="your-bot-token",
    chat_id=123456789,
)
 
# Automatic notifications:
# - New user registrations via OAuth
# - Suspicious login patterns (if implemented)

# Already included in GitHubOAuthService
logger.info(f"GitHub OAuth login for: {user.email}")
logger.warning(f"OAuth state expired: {state[:8]}...")
logger.error(f"GitHub token exchange failed: {status_code}")