Web Security · Middle · Question 51 of 75

What is the `state` parameter in OAuth for?

✓Correct answer: Linking the callback to the request this browser started, preventing CSRF on the redirect endpoint
2Telling the provider which country the user is in
3Storing the user's profile data

Explanation

The client generates a random state, stores it, and checks it when the user comes back. PKCE also covers this, but state is still widely used.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.