The state parameter and CSRF protection

The long-established CSRF countermeasure is that clients pass a random value, a CSRF token, in the state parameter, linking the request to the redirection URI and the user agent session; RFC 6819 Section 5.3.5 describes this in detail. PKCE or the OpenID Connect nonce value provide the same protection. When using PKCE instead of state or nonce for CSRF protection, clients MUST first ensure the authorization server supports PKCE; if it does not, state or nonce MUST be used. The authorization server MUST provide a way to detect its PKCE support, and publishing RFC 8414 authorization server metadata is RECOMMENDED. If state carries application state and the integrity of its contents matters, clients MUST protect it against tampering and swapping, for example by binding the contents to the browser session or by signing and encrypting state values. PKCE protects robustly even against an attacker who can read the authorization response, whereas an attacker who learns a state value can replay it into a forged authorization response. Preferring PKCE for both injection and CSRF protection in new browser-based clients is Koskamo editorial guidance. Scope: OAuth 2.0 security. Reviewed October 4, 2026.