I am new to the CSRF problem and I am studying how CSRF protection is implemented in popular applications like Facebook, Instagram etc. Now I am studying how CSRF protection is used in OAuth implementation.
Some services (Instagram, Todoist) allow to pass an additional argument when an OAuth authorization URL is requested. This argument is described in Instagram:
You may provide an optional state parameter to carry through a server-specific state. For example, you can use this to protect against CSRF issues.
When I elaborated with a different
code the CSRF token in form at the page where the user (dis)allows access to his account, it is the same in all requests even if I provide a different value for
code. Is this OK?
Do you have an idea how they transform
code into CSRF token and how is this token used for CSRF protection? Please could you explain how it works?
I found that one CSRF token per session is probably not a problem and generating unique token per request leads to application problem (back-button etc), source - https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
But still I don't know how is above mentioned
code parameter used or transformed into CSRF token.