News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by catlifeonmars on Sunday March 02, 2025 @11:35PM (#43238339)
> The RP must protect against CSRF when receiving the authorization code

Is this via PKCE or (ID) token nonce validation?

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by chuckadams on Monday March 03, 2025 @08:20AM (#43241451)
A nonce, kept in an extra query parameter named "state". https://stackoverflow.com/a/77029859 has some of the gory details (myself, I just hash the session's CSRF token to generate a state token)
[ Parent | on HN ]