Control Panel - Attack Lab

Security Score

/100

vulnerabilities

Require PKCE High Impact

Prevents authorization code interception

Strict URI Matching Critical

Only allow exact pre-registered URIs

HTTPS Only High Impact

Require HTTPS for redirects

Validate Audience High Impact

Resource servers check token audience

Short Token Lifetime Medium

15 min vs 1 hour token lifetime

Require State Parameter High Impact

Prevents CSRF attacks on callback

Toggle security controls and run attacks to see which ones succeed or fail.

Blocked Succeeded

Configure security controls on the left, then click "Run All Attacks" to see how your configuration holds up against common OAuth vulnerabilities.