Intermediate LevelWeb Security & Cyber Defense
Why is the state parameter mandatory in OAuth 2.0 authorization requests?
❓ Interview Prompt: Explain OAuth 2.0 `state` parameter, Login CSRF attacks, binding auth code responses to client session, and cryptographic state verification.
The 'state' parameter in OAuth 2.0 acts as an Anti-CSRF Token for authorization flows:
Login CSRF Attack Without State:
1
Attacker starts OAuth login and intercepts authorization code 'code_attacker'.
2
Attacker tricks victim into clicking authorization response link containing 'code_attacker'.
3
The victim's session gets logged into the ATTACKER'S account. The victim uploads private documents into what they think is their account, but is actually controlled by the attacker!
•
Fix: Client generates a random 'state' token stored in session and verifies match upon OAuth callback return.
Code Implementation Example
typescript
// 1. OAuth Initiate: Store random state in user session
const stateToken = crypto.randomBytes(16).toString('hex');
req.session.oauthState = stateToken;
const authUrl = 'https://auth.provider.com/oauth/authorize?response_type=code&client_id=123&state=${stateToken}';
// 2. OAuth Callback: Verify returned state matches session!
if (req.query.state !== req.session.oauthState) {
return res.status(403).send('OAuth State Mismatch: Login CSRF Blocked');
}💡Verifying OAuth 2.0 state parameter to prevent Login CSRF attacks.
🎯 Interview Key Takeaway
Include a cryptographically random state parameter in OAuth 2.0 requests to prevent Login CSRF attacks.
#OAuth 2.0#state#Login CSRF#Intermediate
Back to all Web Security & Cyber Defense Questions→