# CD-SEC-03 - Authorization Misuse

> OAuth tokens, refresh tokens, and API keys are provisioned broadly and persist indefinitely.

- **Category**: Owasp Citizen Development
- **Subcategory**: top10
- **Canonical URL**: https://designpattern.fyi/owasp_citizen_development/cdsec03_authorization_misuse/

---

## Description
'**Intent**: Prevent over-provisioned and long-lived OAuth tokens, refresh tokens, and API keys that create zombie connections.

**Context**: OAuth tokens, refresh tokens, and API keys are provisioned broadly "to avoid permission errors," then persist indefinitely and get reused across apps and teams long after the original owner has moved on — creating "zombie connections."

**Solution**: Implement scope reviews at provisioning time. Schedule re-authentication and token rotation. Monitor for over-shared or long-dormant connections. Disable implicit connection sharing by default. Use short-lived tokens with automatic expiration. Implement connection inventory management.'



## Use Cases
Use when managing OAuth tokens, API keys, and service connections in low-code/no-code platforms and AI-assisted development tools.





## Trade-offs


### Advantages

- Reduces zombie connection risk

- Enforces least privilege

- Improves security posture

- Enables connection lifecycle management




### Considerations & Drawbacks

- Token rotation operational overhead

- May break existing integrations

- Requires ongoing monitoring







---
**Reference**: [Original Source](https://owasp.org/www-project-citizen-development-top10-security-risks/)