OAuth state parameter is validated

The OAuth state parameter is the CSRF token for the OAuth flow. Without it, an attacker can initiate an OAuth authorization on behalf of a victim and then complete the flow with the attacker's authorization code, linking the victim's account to the attacker's identity (account linking attack). CWE-352 (CSRF) and CWE-601 (Open Redirect) are both implicated in OAuth flow manipulation; CAPEC-62 documents the OAuth CSRF attack specifically. OWASP A01 (Broken Access Control) covers this when an attacker can substitute their own authorization code. State validation is a mandatory requirement of RFC 6749.

Generate a per-flow cryptographically random state, store it in an HttpOnly cookie before redirecting, and verify it matches on callback:

// Initiation — generate and store state
const state = crypto.randomBytes(16).toString('hex')
response.cookies.set('oauth_state', state, { httpOnly: true, secure: true, sameSite: 'lax' })
return redirect(provider.buildAuthUrl({ state, redirect_uri: callbackUrl }))

// Callback — verify state before processing code
const storedState = request.cookies.get('oauth_state')?.value
const returnedState = searchParams.get('state')
if (!storedState || storedState !== returnedState) {
  return Response.json({ error: 'State mismatch — possible CSRF' }, { status: 400 })
}

NextAuth and Supabase Auth handle state generation and verification automatically. If you've written a custom OAuth callback handler, do not skip this step.