Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

oauth2client/contrib/flask_util.py: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The Flask security decorator failed to enforce base credential requirements when verifying incremental scopes, allowing unauthorized users to satisfy access checks without valid underlying credentials. Developers must ensure that scope authorization checks always validate the existence of valid base credentials.

Auth Bypass: Replay attacks and token reuse were possible because state parameters were retrieved via non-destructive session read operations instead of being immediately popped and invalidated on first use. This allows an attacker to reuse authorization state values.

Auth Bypass: The OAuth2 decorator accepted expired access tokens as valid when no refresh token was present, bypassing re-authentication requirements. Authentication decorators must explicitly verify both token presence and temporal validity.