I just had a quick question regarding Oauth2.0 and the state parameter. Given that I'm generating this initially and then passing it to the authorization server. Assuming I include a randomized component, is there anything wrong with encoding additional values in the string such that I can decode and access them after a response is returned?
Is there anything wrong with encoding additional info in a "state" parameter when used with Oauth?
Viewed 15
1 Answers
The main purpose of the 'state' parameter in OAuth2.0 is to prevent CSRF Attacks.
As per OAuth 2.0 Threat Model and Security Considerations, one can use the 'state' parameter to link to the user's authentication sessions.
If you want to encode additional data to the "state" parameter, my suggestion would be to make sure those additional data are not sensitive as they are exposed in the query parameters.
Related