Skip to content

twobotechnologies

tag: csrf

CSRF

Cross-site request forgery, and how the OAuth state parameter, PKCE and SameSite cookies stop forged redirects and logins.

Articles

Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
/blog/2014/02/importance-of-state-in-oauth2.html

All tags and archives · Glossary