Background: I think I understand how the state
parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.
Situation: I am looking at this in the context of implementing a Shopify App and am having problems to see how the recommended state
check on the client is adding to security in that case.
In Shopify`s oauth flow
- The URL to start the auth flow is tied to a shop (and its logged in admin users), e.g.
https://{shopID}.myshopify.com/admin/oauth/authorize
- The authorization server also sends back a
hmac
signedshop
parameter (in addition to thecode
andstate
parameters) in its response to theredirect_uri
– see Shopify docs
Question:
How is checking the state
in the auth callback within the Shopify Auth flow improving security?
Given
- That the authorization URL is accessible to logged in shop admins only and
- that we can verify the
shop
parameter (via hmac) on the callback/redirect and tie any actions to the corresponding shop/user within our app.
My understanding is that a CSFR attack could only be carried out by another staff/admin account who can log into the same shop anyway and access the same app (in which case there really is no need to carry out a CSFR in the first place)?
What am I missing here?
Thanks for helping me understand this.