2 ms·
> The RP must protect against CSRF when receiving the authorization code Is this via PKCE or (ID) token nonce validation?
by catlifeonmars 2y ago
> The RP must protect against CSRF when receiving the authorization code
Is this via PKCE or (ID) token nonce validation?
- chuckadams 2y agoA nonce, kept in an extra query parameter named "state". https://stackoverflow.com/a/77029859 https://stackoverflow.com/a/77029859 has some of the gory details (myself, I just hash the session's CSRF token to generate a state token)