Yes—an OAuth client should reject a callback that reuses a state value it has already accepted. Treat state as a transaction-bound, single-use marker: generate it for the authorization attempt, bind it to the initiating user agent, validate it against the pending transaction at the redirect endpoint, and invalidate it after its first successful use. This creates a clear boundary against replay after acceptance, but it cannot stop an attacker who obtains the value before the legitimate callback arrives.
What OAuth state protects—and what it does not
The OAuth client’s redirect endpoint must be protected against cross-site request forgery (CSRF). RFC 6749 requires the client to implement CSRF protection for that endpoint and describes state as a non-guessable value used to bind the authorization response to the user agent’s authenticated state. See RFC 6749, The OAuth 2.0 Authorization Framework.
As an Amazon Associate I earn from qualifying purchases.
RFC 9700, the IETF’s January 2025 Best Current Practice for OAuth 2.0 security, makes the replay boundary explicit: when state is used for CSRF protection, it must be one-time-use and securely bound to the user agent. The client should invalidate it after its first use at the redirection endpoint. A second callback carrying that consumed value should fail validation. See RFC 9700, Best Current Practice for OAuth 2.0 Security.
This protects against reuse after the client has accepted the legitimate callback. It does not make a leaked value safe: if an attacker learns state before the legitimate response reaches the client, the client has not yet consumed it. RFC 9700 warns that learning the value can defeat the CSRF protection it provides.
How to enforce one-time use at the callback
- Create a transaction-specific value. Generate a non-guessable
statevalue for each authorization attempt rather than sharing one across attempts. - Bind it to the initiating user agent and pending transaction. Keep an association that lets the callback be checked against the browser session and the authorization attempt that initiated it.
- Validate the callback against that pending transaction. Reject a missing, mismatched, expired, or already-consumed value; do not treat a syntactically valid callback as sufficient.
- Consume it on the first successful validation. Record invalidation as part of accepting the callback. Make the check-and-consume operation atomic so two concurrent deliveries cannot both pass.
The one-time-use requirement and first-use invalidation come from RFC 9700. Atomic check-and-consume is an implementation consequence of that requirement: the RFC specifies the security outcome, not a particular database, cache, lock, or concurrency primitive.
Where the replay boundary ends
Once a value has been successfully used, a later callback replay should be rejected. But first-use invalidation does not address theft before that point. Review how the authorization request and response travel through the browser: URLs can be exposed through third-party content or referrer behavior before the client consumes the value. Preventing leakage and securely binding the value remain necessary.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
If state also carries application data, do not assume that matching the outer value protects the embedded data. Bind that data to the browser session, and use signing or encryption when needed to protect its integrity or confidentiality. This helps prevent tampering or swapping of payloads.
Recommended Free Tools
When PKCE or OpenID Connect nonce changes the choice
RFC 9700 permits a client to rely on PKCE for CSRF protection only when the client has ensured that the authorization server supports PKCE. If that support is not established, use state or an OpenID Connect nonce for CSRF protection. PKCE challenges and OIDC nonces must themselves be transaction-specific and securely bound to the client and user agent.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Choosing a mechanism is not a reason to drop transaction binding. Confirm the authorization server’s PKCE support and ensure the selected protection belongs to the same pending attempt and initiating browser.
Quick Recap
Rank #4
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
Review an implementation against these checks
- Binding: Is the value associated with the initiating browser or user agent and the client’s pending authorization attempt?
- One-time enforcement: Does the first successful callback consume it, and will a repeated or concurrent callback be rejected?
- Leakage exposure: Could third-party content or referrer behavior expose the authorization request or response URL before consumption?
- Payload integrity: If application data is included, is it session-bound, signed, or encrypted as appropriate to prevent tampering or swapping?
- Alternative CSRF mechanism: Has PKCE support been established for this authorization server, or is
stateor OIDCnoncestill needed?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
