A silent attacker watches your OAuth 2.0 session. One replay, and they own the request, the token, the access.
Session replay in OAuth 2.0 happens when a valid authorization request, code, or token is captured and reused without the user’s consent. It bypasses login, it ignores expiration, it moves like the original event. The protocol itself does not stop it. Only proper implementation and hardened defenses will.
OAuth 2.0 uses tokens—authorization codes, access tokens, refresh tokens—to manage identity and permissions. If one of these is intercepted, a replay attack can make a backend accept it as if it were new. Common vectors include insecure redirects, unencrypted transport, poorly scoped tokens, and missing state parameters. Any gap in transport-layer security can give the attacker a full key to the kingdom.
To prevent session replay, enforce TLS everywhere with strong cipher suites. Validate state parameters on every OAuth 2.0 authorization request. Bind tokens to the client and user context with techniques like sender-constrained tokens or proof-of-possession. Use short-lived access tokens and rotate refresh tokens frequently. Audit redirect URIs and block any that aren’t explicitly whitelisted. Instrument logging to detect anomalies—same token used from different IPs, rapid request bursts, odd geolocation patterns.