Is there a way of passing a custom csrf_state through the Plaid OAuth flow?

tcmoore 0
Viewed 25

With a standard Oauth client, I can configure custom params passed through the csrf state, i.e. "{org_id}:{service}:{random_characters}"

For Brex, for example, this might look like "org_1:brex:cd8T6tDwuUVWtnOs"

Is there a way of passing custom identifiers like this through the Plaid Oauth flow to be received on the redirect?

Note: I am using Rust and the plaid-rs crate. My link token request code looks like this:

  let client = plaid::PlaidClient::from_env();
  let res = match client
    .link_token_create(LinkTokenCreateRequired {
      client_name: "MyCompany",
      language: "en",
      country_codes: &PLAID_COUNTRY_CODES,
      user: LinkTokenCreateRequestUser {
        client_user_id: user.id.clone(),
        ..Default::default()
      },
    })
    .redirect_uri(format!("{}/oauth2/callback", api_url))
    .products(
      PLAID_PRODUCTS
        .iter()
        .map(|p| p.to_string())
        .collect::<Vec<_>>(),
    )
    .webhook(format!("{}/webhook", api_url))
    .send()
    .await
plaid csrf oauth oauth-2.0
2 Answers

It's been over a decade since I've worked directly with CSRF tokens, so let me know if this doesn't answer your question, but here's what the support folks had to say:

When Link is reinitialized with the receivedRedirectUri field properly configured, user state data will be preserved. The received redirect URI is your redirect URI appended with an OAuth state ID parameter. The OAuth state ID parameter will allow you to persist user state when reinitializing Link.

Lots more details about receivedRedirectUri can be found in the OAuth docs. https://plaid.com/docs/link/oauth/

userFTq60

From conversations with the Plaid dev support team, I think unfortunately the answer is... no.

tcmoore0
Related