Auth Security Parameters Cheat Sheet

Modern authentication flows (OAuth 2.0 and OIDC) don't just send usernames and passwords. They use specific parameters to prove that the request is legitimate and that the response hasn't been tampered with. This page maps these technical parameters to the security threats they are designed to mitigate.

The Mapping (one glance)

Parameter Threat Mitigated Applicable Flow Core Concept
nonce Token Replay Implicit Flow Session Binding
state CSRF General OAuth 2.0 Request Validation
code_challenge Code Interception Auth Code Flow PKCE (Public Clients)
code_verifier Code Interception Auth Code Flow PKCE (Secret Proof)

Deep Dive: How they work

> NONCE (Number used once) The client generates a random string and sends it in the request. The auth server embeds this exact string in the resulting ID Token.
  • The Win: If an attacker intercepts a token and tries to "replay" it later, the client checks the nonce. If it doesn't match the current session's nonce, the token is rejected.
  • Flow: Primary for the Implicit Flow.
> STATE A unique string generated by the client and sent to the auth server, which must be returned exactly as-is in the redirect response.
  • The Win: Prevents Cross-Site Request Forgery (CSRF). It ensures the response coming back to the callback URL was actually initiated by the user in the current session, not an attacker injecting a pre-captured response.
  • Flow: Standard across all OAuth 2.0 flows.
> PKCE (Proof Key for Code Exchange) PKCE replaces the need for a Client Secret in public clients (like SPAs or Mobile Apps) where a secret cannot be safely stored.
  • The Win: Prevents Authorization Code Interception. Even if an attacker steals the code from the URL, they cannot exchange it for a token because they lack the original secret used to create the challenge.
  • Flow: The gold standard for Authorization Code Flow.
The PKCE Chain: The client creates a secret code_verifier, hashes it into a code_challenge, and sends the challenge first. Later, it sends the original verifier. The server hashes the verifier and checks if it matches the original challenge.