How can I validate the state param?

[arbnorlumezi]

From my application I am able to add a url in state param as so:

While using: GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API

https://companyname.okta.com/oauth2/default/v1/authorize?

client_id=123123123&response_type=code&scope=openid&redirect_u

ri=https%3A%2F%board.companyname.com%2Fauthorization-code

%2Fcallback&state=https://www.facebook.com/

With the above example after successful login I am redirected to Facebook.com

The lack of URL validation here introduces an arbitrary redirect vulnerability that can be abused for phishing attempts or as part of a complex attack chain.

How can I validate the state param to make sure this does not happen?

I tried a few ways following the documentation but nothing works so far.

[ram.gandhi]

I answered something similar a while back. Let me know if this answers your question

Dynamic redirect in the authorization callback in node express?

You can use state parameter to send some data during authorize call, which will be returned back to the callback url after authentication. You can send in a destination URL as state which will be returned to the callback url. But ideally you might have to generate an opaque value and pair it with the destination url in a local store. Then send this opaque value as state and use it in callback url code to redirect user to destination URL

[arbnorlumezi]

Not really my case.
I have already defined a redirectUri, instead if being directed there I’m being directed to the potential attackers url.

[ram.gandhi]

But ideally you might have to generate an opaque value and pair it with the destination url in a local store. Then send this opaque value as state and use it in callback url code to redirect user to destination URL

I will provide detailed steps with an example.

• You create a unique opaque value such as a uuid - 7e981003-1ddb-4732-a9cf-c97087c79fb5
• Store it in client storage such as localstorage/sessionstorage along with your destination url - {“7e981003-1ddb-4732-a9cf-c97087c79fb5”: “https://www.facebook.com/”}
• Make authorize with this id as state - https://companyname.okta.com/oauth2/default/v1/authorize?client_id=123123123&response_type=code&scope=openid&redirect_uri=https%3A%2F%board.companyname.com%2Fauthorization-code%2Fcallback&state=7e981003-1ddb-4732-a9cf-c97087c79fb5
• During callback use this value to lookup destination url from your client storage and redirect

By using this method, your destination URL will be something from your client storage. If someone tampers with the state, you will not find a match and can respond with an error and/or retry authorize again.