Background: I think I understand how the
state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.
Situation: I am looking at this in the context of implementing a Shopify App and am having problems to see how the recommended
state check on the client is adding to security in that case.
In Shopify`s oauth flow
- The URL to start the auth flow is tied to a shop (and its logged in admin users), e.g.
- The authorization server also sends back a
shopparameter (in addition to the
stateparameters) in its response to the
redirect_uri– see Shopify docs
How is checking the
state in the auth callback within the Shopify Auth flow improving security?
- That the authorization URL is accessible to logged in shop admins only and
- that we can verify the
shopparameter (via hmac) on the callback/redirect and tie any actions to the corresponding shop/user within our app.
My understanding is that a CSFR attack could only be carried out by another staff/admin account who can log into the same shop anyway and access the same app (in which case there really is no need to carry out a CSFR in the first place)?
What am I missing here?
Thanks for helping me understand this.