Problem

The GitHub platform-connect flow (/api/connect/github) generated a nonce embedded in the OAuth state parameter but never persisted or validated it server-side.

The callback flow only validated the structure of the decoded payload:

if (
  typeof decoded.userId !== 'string' ||
  typeof decoded.nonce !== 'string'
) {
  return null;
}

and then trusted the attacker-controlled userId from the state payload when storing OAuth credentials.

Because the nonce was never:

• persisted,
• cross-checked,
• expired,
• or invalidated,

an attacker could forge arbitrary OAuth state payloads and link their GitHub account to another user's DevCard profile.

Security Impact

This created a realistic OAuth CSRF/account-linking vulnerability.

An attacker could:

1. obtain a victim's user ID,
2. generate a forged OAuth state,
3. complete GitHub OAuth using their own GitHub account,
4. submit the forged state during callback handling.

The backend would then:

• trust the forged userId,
• exchange the OAuth code,
• and persist the attacker's GitHub token under the victim's account.

This could result in:

• unauthorized account linking,
• incorrect OAuth identity association,
• replay attacks,
• and compromised social integration integrity.

Fix

apps/backend/src/routes/connect.ts

Implemented full server-side nonce persistence and validation.

OAuth Initiation

• generates a cryptographically secure nonce using:

  randomBytes(32).toString('hex')

• stores:

  oauth_nonce:{nonce} -> userId

  in Redis
• applies a strict 600-second TTL
• fails closed if Redis persistence fails

OAuth Callback

The callback flow now:

1. safely parses and validates state structure
2. looks up the nonce in Redis
3. verifies nonce ownership matches the expected user
4. deletes the nonce immediately after validation
5. rejects:
   • forged nonces
   • expired nonces
   • replay attempts
   • mismatched user IDs
6. uses the Redis-sourced user ID as authoritative instead of trusting attacker-controlled state payloads

Additionally:

• Redis failures now fail closed
• token exchange never occurs for invalid state
• nonce consumption is single-use and replay-safe

Security Properties

The updated flow is now:

• Replay-safe

  • nonces are consumed immediately after validation

• Forgery-resistant

  • attackers cannot generate valid server-issued nonces

• Fail-closed

  • Redis failures abort the OAuth flow safely

• Server-authoritative

  • user association comes from Redis, not client-controlled state

Tests

Replaced the previous placeholder OAuth tests with comprehensive regression coverage in:

apps/backend/src/__tests__/connect.test.ts

Added coverage for:

• valid OAuth flow
• forged nonce attempts
• replay attacks
• mismatched user IDs
• malformed base64 state
• malformed JSON payloads
• missing parameters
• Redis persistence failures
• Redis lookup failures
• expired/consumed nonces
• GitHub token exchange failures
• nonce TTL validation

Result

• OAuth state validation is now enforced server-side
• Replay attacks are prevented
• Forged account-linking attempts are rejected
• Nonces are single-use and time-bound
• Existing legitimate OAuth behavior remains unchanged

Fixes #223