# OAuth Authorization State Parameter

**URL:** <https://devforum.okta.com/t/oauth-authorization-state-parameter/6330>\
**Category:** Questions\
**Created:** [September 19, 2019, 1:28pm UTC](https://devforum.okta.com/t/oauth-authorization-state-parameter/6330 "2019-09-19T13:28:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shahzebjadoon](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@shahzebjadoon](https://devforum.okta.com/u/shahzebjadoon)\
**Post date:** [September 19, 2019, 1:28pm UTC](https://devforum.okta.com/t/oauth-authorization-state-parameter/6330/1 "2019-09-19T13:28:42Z")

</div>

Passing state in OAuth authorization will remains same for a user or session? If client request to access our system, de we need to change the state on every request ?

---

<div class="post-metadata">

**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\
**Post date:** [September 20, 2019, 12:25pm UTC](https://devforum.okta.com/t/oauth-authorization-state-parameter/6330/2 "2019-09-20T12:25:57Z")

</div>

If you are using auth code flow the state parameter will be passed back in response of auth code request: [https://developer.okta.com/docs/guides/implement-auth-code/use-flow/](https://developer.okta.com/docs/guides/implement-auth-code/use-flow/)

As described in RFC 6749:

state  
RECOMMENDED. An opaque value used by the client to maintain  
state between the request and callback. The authorization  
server includes this value when redirecting the user-agent back  
to the client. The parameter SHOULD be used for preventing  
cross-site request forgery

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [October 1, 2019, 6:33am UTC](https://devforum.okta.com/t/oauth-authorization-state-parameter/6330/3 "2019-10-01T06:33:06Z")

</div>

Hi @shahzebjadoon

State is a way to link the requests, from when the user is sent to Okta’s /authorize endpoint, up until the application receives the JWTs. Depending on your application configuration and security policy, it can be the same state (eg. for an IP address) or different every time.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 18, 2024, 12:19am UTC](https://devforum.okta.com/t/oauth-authorization-state-parameter/6330/4 "2024-01-18T00:19:40Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.