Simulating OAuth2 Token Theft

In this lesson, you will learn how to conduct a tabletop exercise to evaluate your team's incident response procedures when an OAuth2 access token is compromised.

While your security scanning and request signing help prevent theft, a "tabletop exercise" moves beyond code to test human and systemic readiness. You simulate a scenario where an attacker has successfully exfiltrated a valid access_token and is using it to query your Node.js API.

The Tabletop Exercise Process

A tabletop exercise isn't about deploying live malware; it is a facilitated discussion where stakeholders walk through a specific narrative. To simulate an OAuth2 theft, present your team with this scenario:

"An attacker has exfiltrated a JWT from a user's browser via XSS. They are currently using that token to call the /api/user/settings endpoint. Our monitoring tools have detected anomalous behavior. What do we do?"

Step-by-Step Simulation

During the exercise, force your team to answer these critical questions:

1. Detection: Which logs or metrics (e.g., unexpected IP addresses, impossible travel, or unusual user-agent strings) would flag this?
2. Containment: Can we revoke this specific token immediately? If your system uses stateless JWTs, do you have a blacklist mechanism or a way to rotate the user's signing keys?
3. Communication: Who is notified? Does the user need to be logged out of all devices?
4. Forensics: Can we trace which resources were accessed during the window of theft?

Practical Validation

To make it concrete, try to manually simulate the effect of a stolen token by crafting an Authorization header request in a controlled test environment:

// Test script to see if our API detects anomalous token usage
const axios = require('axios');

async function testTokenTheftResponse() {
  try {
    const response = await axios.get('https://api.myapp.com/v1/profile', {
      headers: { 'Authorization': 'Bearer <STEALEN_TOKEN_HERE>' }
    });
    console.log("Access granted. Incident response needed!");
  } catch (error) {
    console.log("Access denied. Security controls held.");
  }
}

By running this script, you verify that your API’s validation logic (e.g., checking token scopes or expirations) functions as expected, while the "tabletop" component ensures your team knows how to react when those controls fail.

Key Takeaway: Tabletop exercises reveal the gap between having security code in place and having a functional, practiced incident response strategy for compromised tokens.