OAuth state parameter is validated when handler is hand-rolled

A hand-rolled OAuth callback that processes the code parameter without comparing the state value to a stored cookie value is vulnerable to CSRF on the OAuth flow itself. CWE-346 (Origin Validation Error) and CWE-352 describe the attack: an attacker can initiate their own OAuth flow and trick a victim into completing it, linking the victim's account to the attacker's third-party identity. This enables account takeover without knowing the victim's credentials. Auth libraries (NextAuth, Clerk, Lucia) handle state internally — only hand-rolled callbacks are vulnerable.

Use a hosted auth library (NextAuth, Clerk, Lucia) if possible — state validation is handled internally. For hand-rolled callbacks, generate a random state on authorization request, store it in a cookie, and compare it on callback.

// app/api/auth/callback/github/route.ts
export async function GET(req: Request) {
  const url = new URL(req.url)
  const code = url.searchParams.get('code')
  const stateParam = url.searchParams.get('state')
  const cookieStore = await cookies()
  const cookieState = cookieStore.get('oauth_state')?.value

  if (!stateParam || !cookieState || stateParam !== cookieState) {
    return Response.json({ error: 'Invalid state' }, { status: 400 })
  }

  cookieStore.delete('oauth_state')  // consume the state
  // now safe to exchange code for token
}