security authentication ai_generated true

OAuth2 authorization code can be injected by attacker due to missing state parameter validation

ID: security/oauth2-state-parameter-csrf

Also available as: JSON · Markdown
92%Fix Rate
95%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
2 active — — —

Root Cause

OAuth2 state parameter prevents CSRF in the authorization flow. Without it, an attacker can trick a user into logging in with the attacker's account (login CSRF) by sending them a crafted callback URL with the attacker's authorization code.

generic

Workarounds

  1. 98% success Generate cryptographic random state, store in session, validate on callback 
    state = secrets.token_urlsafe(32); session['oauth_state'] = state; # in callback: assert request.args['state'] == session.pop('oauth_state')
  2. 95% success Use both state AND PKCE together for maximum security 
    State prevents CSRF. PKCE prevents code interception. They are complementary, not alternatives.
  3. 90% success Use established OAuth libraries (authlib, passport) that handle state automatically 
    Libraries like authlib automatically generate, store, and validate state parameter

Dead Ends

Common approaches that don't work:

  1. Omit state parameter because PKCE is used for security 88% fail

    PKCE prevents authorization code interception but does NOT prevent CSRF/login-CSRF attacks. State and PKCE serve different purposes.

  2. Use a static/predictable state value 95% fail

    State must be unpredictable and tied to the user's session. A static value provides zero CSRF protection.