Interface: ParseCallbackUrlOptions

Defined in: src/core/oauth/parseCallbackUrl.ts:3

Properties

expectedState

expectedState: string;

Defined in: src/core/oauth/parseCallbackUrl.ts:10

The state you generated for this authorization request and stored against the user's session.

Checked before anything else. This is what stops an attacker from replaying someone else's callback into your session, and it only works if the value is unguessable and bound to that one user.