Using [0] as a reference, I'm talking about Step 3. This is, in my experience, the "normal" way that people are setting up OAuth between 2 services, with a user

Using [0] as a reference, I'm talking about Step 3. This is, in my experience, the "normal" way that people are setting up OAuth between 2 services, with a user going through the flow. [1] includes info on this (see "flawed CSRF protection") [0]: https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2#step-3-application-receives-authorization-code https://www.digitalocean.com/community/tutorials/an-introduc... [1] https://portswigger.net/web-security/oauth https://portswigger.net/web-security/oauth