liveBook · Manning

State parameter

As explained in Secure APIs

An opaque client-generated OAuth value that binds an authorization response to the initiating request.

A state parameter is an opaque, unguessable value generated for an OAuth authorization request. Bind it to that request and carry it through every request and response until the access-token exchange. section 7.4.1

It protects against authorization-endpoint CSRF and access-token hijacking. Without it, a malicious site can trigger authorization while a user is already logged in, receive an authorization code, and exchange it for an access token. section 7.4.1 section 10.3

Authorization request

An authorization URL can include `state=35ce` alongside `response_type`, `client_id`, and `redirect_uri`. The client carries the bound state value throughout the flow rather than treating the authorization code alone as sufficient protection. section 7.4.1

How Secure APIs covers it

How deep it goes
Explains opacity, unpredictability, request binding, and propagation, while deferring authorization-code hijacking defenses to proof of key exchange.
Examples
Uses a malicious-link attack scenario and an authorization URL containing `state=35ce`.
What it assumes
Assumes familiarity with OAuth authorization requests, redirect URLs, authorization codes, and access tokens.
What you can do after
Apply it by binding an opaque value to each authorization request and carrying it through the complete OAuth flow.
How it connects
Connects OAuth authorization code flow with CSRF, redirect URI, access tokens, and proof of key exchange.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.