I noticed that auth0js has a nonce parameter: Auth0.js v9 Reference , and was curious about the protection that offers vs the state parameter that is recommended to mitigate CSRF attacks ( Auth0.js v9 Reference and https://auth0.com/docs/protocols/oauth2/oauth-state )? Why is state needed to prevent t…

State vs nonce in auth0-js

Topic		Replies	Views
Why use state, or even nonce? Get Help	2	5816	April 2, 2018
Where should the 'state' nonce be generated and checked? Get Help authorization-code-f , state	2	10008	July 25, 2019
SPA's don't do authentication (replay attacks) Get Help	2	4573	July 25, 2019
Proper auth0-js state/nonce management? Get Help auth0	1	4753	December 19, 2019
Are nonce and state automatically verified? Get Help	1	3535	April 23, 2020