Cross-site request forgery (CSRF) tricks an authenticated user’s browser into sending an unintended authorization request. In OAuth, the attacker can obtain an authorization code and exchange it for an access token. section 7.4.1 section 10.3
A typical attack starts with a malicious link or website. If the user already has an active identity-provider session, the authorization step is skipped. An unconstrained redirect_uri can send the resulting code to the attacker’s server. section 7.4.1 section 10.3
Defend the authorization flow by:
- Requiring an opaque, unguessable state value, binding it to the client’s request, and carrying it through every request and response until token exchange. section 7.4.1
- Constraining redirect_uri values so attackers cannot use an open redirect to capture authorization codes. section 7.4.1
- Apply FAPI’s additional session-integrity requirements when stronger protection against authorization-endpoint CSRF is needed. section 10.3
https://auth.example.com/authorize?response_type=code &client_id=s6BhdRkqt3&redirect_uri=https://example.com&state=35ce
Use the authorization URL to inspect how a state value accompanies the client identifier and redirect URI. section 7.4.1
