Request Forgery: OAuth Missing State Validation¶

Identifier: oauth_missing_state_validation

Scanner(s) Support¶

Description¶

OAuth authorization flows should validate the state parameter to bind authorization responses to the initiating browser session.

How we test: We inspect OAuth authorization flows and callback handling to detect missing, static, reusable, or unvalidated state values. Missing state validation can result in CSRF attacks that force user sessions, such as login CSRF or account-linking attacks where a victim is silently bound to an attacker-controlled OAuth session.

References:

• https://datatracker.ietf.org/doc/html/rfc6749#section-10.12
• https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  oauth_missing_state_validation:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.