Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.

Situation: I am looking at this in the context of implementing a Shopify App and am having problems to see how the recommended state check on the client is adding to security in that case.

In Shopify`s oauth flow

  • The URL to start the auth flow is tied to a shop (and its logged in admin users), e.g. https://{shopID}.myshopify.com/admin/oauth/authorize
  • The authorization server also sends back a hmac signed shop parameter (in addition to the code and state parameters) in its response to the redirect_uri – see Shopify docs

Question: How is checking the state in the auth callback within the Shopify Auth flow improving security?


  • That the authorization URL is accessible to logged in shop admins only and
  • that we can verify the shop parameter (via hmac) on the callback/redirect and tie any actions to the corresponding shop/user within our app.

My understanding is that a CSFR attack could only be carried out by another staff/admin account who can log into the same shop anyway and access the same app (in which case there really is no need to carry out a CSFR in the first place)?

What am I missing here?

Thanks for helping me understand this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.