FlowAnalyzer
title: FlowAnalyzer type: tool created: 2026-05-26 last_updated: 2026-05-26 related: ["radar/platforms/Casdoor", "radar/platforms/Permify", "radar/techniques/SecureByDesign"] sources: ["https://github.com/ManuelBerrueta/FlowAnalyzer"] radar_quadrant: Tools radar_ring: Assess radar_position: inner
Security tool for intercepting and visualising OAuth 2.0 and OIDC token exchange flows during authentication implementation review. Sits between an application and its auth provider to surface the actual protocol steps, parameters, and token contents.
OAuth 2.0 and OIDC work through a multi-step redirect-and-exchange sequence. Implementing them correctly requires that each step is validated: the state parameter must be checked to prevent CSRF, the nonce must be validated in the ID token, PKCE must be applied for public clients, token expiry must be enforced, and redirect URIs must be strictly validated.
FlowAnalyzer acts as a transparent proxy or interceptor during testing, capturing each step of the flow and presenting it in a structured format. For each request and response in the sequence you can see:
- Which endpoints were called and in what order
- What parameters were sent (scope, state, nonce, code_challenge, etc.)
- What tokens were returned and their decoded claims
- Whether required parameters are present or missing
This makes it possible to audit an implementation by observation rather than code inspection alone.
- Implementation audit — confirming that a new OAuth/OIDC integration handles state, nonce, PKCE, and token validation correctly before deploying to production
- Library evaluation — verifying that an auth library does what its documentation claims at the protocol level
- Debugging — diagnosing why an auth flow fails without reading raw HTTP logs
- Security review — identifying deviations from the OAuth/OIDC spec that create exploitable conditions
radar/platforms/Casdoor provides the IAM and SSO platform — it is the auth server. radar/platforms/Permify handles authorization policy decisions. FlowAnalyzer sits at the verification layer: it checks that the integration between an application and an auth server (Casdoor or otherwise) is implemented correctly. The three tools address different concerns in the auth stack.
FlowAnalyzer sits in the Assess ring of the Tools quadrant, at inner position. First studied via GitHub repository (2024-08-02). Inner position reflects direct applicability to any project implementing OAuth/OIDC authentication — a nearly universal requirement for any web application with user accounts — and strong complementarity with the auth and authz blips already on the radar. Remaining gate before Trial is use in a real security review of an OAuth/OIDC integration where the tool surfaces at least one misconfiguration or confirms a correct implementation.
