3 ms·
The article that is linked in the SO post actually makes exactly that point: > Some people believe that using the state parameter in OAuth protects against tok
by littlecranky67 3y ago
The article that is linked in the SO post actually makes exactly that point:
> Some people believe that using the state parameter in OAuth protects against token substitution.
The only binding a browser cookie to state protects against is Cross Site Scripting.
Note that I am not arguing about this point as I don't understand nearly enough about OAuth/OIDC, just pointing out this has been adressed in the article.