title: How Secure Is Too Secure in OAuth 2.0?
body: <p>Background: I am currently on a team responsible for building an API for University College, London. </p>
  
  <p>I am responsible for building an implementation of OAuth which sits on top of Shibboleth that we can provide to our users. In order to keep it as secure as possible (we are going to be providing student data, so we can't take any risks here), I have implemented a nonce parameter along with a <code>client_secret_proof</code> parameter (the <code>appsecret_proof</code> that is described at sakurity.com/oauth).</p>
  
  <p>The difference is that in my implementation a request is made to a nonce endpoint and then this nonce value is concatenated onto the user's token then run through the HMAC algorithm so that the <code>client_secret_proof</code> parameter cannot be replayed.</p>
  
  <p>The question here is that my PM thinks this extra protection is unnecessary and just terrible for Developer Experience, but I want to try and make it as difficult as possible to MITM the connection and do as much as I can to prevent the leaking of client secrets by sloppy programming on the part of our student developers. Am I wasting my time in toughening up OAuth here, or is OAuth 2.0 inherently weak when it comes to preventing certain types of attacks? My main concern is developers not properly validating HTTPS certificates which would render the protection already present in HTTPS moot.</p>
  
  <p>Thank you so much for any thoughts you have on this! We don't want to offer a terrible Developer Experience, but we don't want to leave any attack vectors unconsidered either.</p>
  
  <p>Implementation of protection: <a href="https://github.com/uclapi/uclapi/blob/OAuth/backend/uclapi/oauth/decorators.py#L86" rel="nofollow noreferrer">https://github.com/uclapi/uclapi/blob/OAuth/backend/uclapi/oauth/decorators.py#L86</a></p>
  
  <p>Client library: <a href="https://github.com/uclapi/django-uclapi-oauth/blob/master/apidemo/uclapi/views.py" rel="nofollow noreferrer">https://github.com/uclapi/django-uclapi-oauth/blob/master/apidemo/uclapi/views.py</a></p>