CSRF_TOKEN_MISSING security auth_error ai_generated true

OAuth2授权码注入：缺少state参数导致跨站请求伪造

OAuth2 authorization code injection: missing state parameter enables CSRF

ID: security/oauth2-state-parameter-missing

其他格式: JSON · Markdown 中文 · English
92%修复率
90%置信度
1证据数
2023-05-20首次发现

版本兼容性

版本状态引入弃用备注
OAuth2 2.0 RFC 6749 active — — —
Passport.js 0.6.0 active — — —
OmniAuth 2.1.0 active — — —

根因分析

OAuth2客户端未生成或验证加密随机的state参数，使攻击者可以将自己的授权码注入到受害者的会话中。

English

The OAuth2 client does not generate or validate a cryptographically random state parameter, allowing an attacker to inject their own authorization code into a victim's session.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc6749#section-10.12

解决方案

  1. Generate a cryptographically random state value per request, store it in the user session, and validate it on callback. Example in Node.js: const state = crypto.randomBytes(16).toString('hex'); req.session.oauthState = state; res.redirect(authUrl + '&state=' + state);
  2. Use PKCE (Proof Key for Code Exchange) with S256 challenge method, which inherently binds the authorization code to the client session
  3. Enforce state parameter validation at the authorization server level by rejecting requests without a valid nonce

无效尝试

常见但无效的做法:

  1. 95% 失败

    Static state is predictable and does not prevent CSRF; attacker can guess or reuse it.

  2. 70% 失败

    Cookie-only state can be stolen via XSS or reused across sessions.

  3. 85% 失败

    Redirect_uri matching does not prevent CSRF; attacker can still inject code via a pre-registered URI.