A 24-hour token in all the wrong places

The challenge

A multi-tenant platform in a regulated sector needed an authenticated, multi-role test of its web and API product and its OAuth identity layer.

How it unfolded

1. Tested the web + API product across multiple roles and the OAuth identity layer.
2. Found a long-lived (24-hour) API token returned in a URL fragment during SSO handoff.
3. Found the same token class embedded in a page-level JavaScript global.
4. Found it obtainable via an enabled resource-owner-password grant with long-lived refresh tokens on a public client.
5. Confirmed tokens were not revoked on logout — widening the window for theft and reuse.
6. Found a disabled-but-leaky GraphQL endpoint disclosing schema, and an order workflow accepting client-supplied status and dates.

Impact

A single client-side foothold translated into a full day of access to the records behind it.

Outcome

A token-lifecycle redesign (authorization-code + PKCE, short lifetimes, server-side revocation, no tokens in URLs or globals) and server-side workflow validation — closing the chain at its root.