# OIDC 授权请求缺少 state 参数，允许对回调进行 CSRF 攻击

- **ID:** `security/oidc-state-parameter-missing-allows-csrf`
- **领域:** security
- **类别:** auth_error
- **错误码:** `OIDC_MISSING_STATE`
- **验证级别:** ai_generated
- **修复率:** 95%

## 根因

OpenID Connect 授权请求未包含加密随机的 'state' 参数，使攻击者能够将其自己会话中的授权代码注入受害者的回调，将受害者的帐户与攻击者的身份关联起来。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| OpenID Connect Core 1.0 | active | — | — |
| Keycloak 22.0.0 | active | — | — |
| Auth0 React SDK 2.0.0 | active | — | — |
| oidc-client-ts 2.4.0 | active | — | — |
| Spring Security OAuth2 Client 6.1.0 | active | — | — |

## 解决方案

1. ```
   Generate a cryptographically random state value for each authorization request and validate it in the callback. Example in Node.js using crypto: `const state = crypto.randomBytes(16).toString('hex'); session.state = state; res.redirect(`https://auth.example.com/authorize?state=${state}&...`);` and on callback: `if (req.query.state !== session.state) { reject('CSRF detected'); }`.
   ```
2. ```
   Use a high-quality OIDC library that automatically handles state generation and validation (e.g., `openid-client` in Node.js or `oidc-client-ts` in JavaScript).
   ```

## 无效尝试

- **** — A static state is predictable and can be reused by an attacker; it provides no CSRF protection. (99% 失败率)
- **** — Nonce is verified in the ID token, but the authorization code exchange may occur before ID token validation; state is the primary CSRF defense for the code flow. (85% 失败率)
- **** — Redirect URI binding does not prevent code injection; an attacker can still intercept the callback if the redirect URI is open to manipulation. (90% 失败率)