What is the purpose of the state parameter in OAuth?

• A. An opaque value used to maintain state between request and callback
• B. A flag to indicate if the request is secure
• C. A parameter to indicate response type
• D. A token with expiration

Answer: (A)

The state parameter in OAuth is used to tie an authorization request to its callback and protect the flow from cross-site request forgery. When you start the OAuth flow, you generate an opaque state value (often a random string or a CSRF token) and store it on the client side. You send this value along with the authorization request. When the authorization server redirects back to your app, it includes the same state value. Your app then verifies that the returned state matches what you originally sent before proceeding to exchange the authorization code or tokens. This ensures the response corresponds to a request you initiated and helps prevent malicious requests from being able to replay or hijack the flow.

It isn’t a flag for secure requests, a parameter indicating the response type, or a token with expiration.