FrontendHaltSecurity·Advanced·Conceptual·1 min read
What is the purpose of the state parameter in an OAuth redirect flow?
Short interview answer
It is an unpredictable value the client generates before redirecting and verifies on return, preventing an attacker from tricking a user into completing an authorization flow initiated by the attacker.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.