OAuth CSRF & the Missing state Parameter

The state parameter is OAuth's CSRF token. It must be a random, session-bound value generated before the redirect and verified on return. When it is missing or unchecked, the callback can be forged.

How it works

An attacker starts an OAuth flow with their own account and captures the resulting authorization code (before redeeming it). They then trick a victim into visiting /callback?code=<attacker_code>. The victim's client redeems the attacker's code and links the attacker's identity into the victim's session — or logs the victim into the attacker's account, capturing everything the victim then does.

How to test

Remove or replace the state value on the callback. If the flow still completes, state is not being verified. Confirm it is unpredictable and single-use.

Impact

Session fixation/CSRF on login, account linking attacks, and harvesting of victim data entered into an attacker-controlled account.

Defenses

• Generate a random state, store it bound to the session, and reject callbacks whose state doesn't match.
• Combine with PKCE; treat state as single-use.