When talking about state, the documentation and the posts in this forum talk about how it is intended to prevent CSRF attacks. How does it do this? If I send a value to Auth0 when a user logs in - as the documentation says to do every time - if the request were being intercepted, the third-party …

Why use state, or even nonce?

Topic		Replies	Views
SPA's don't do authentication (replay attacks) Get Help	2	4575	July 25, 2019
State vs nonce in auth0-js Get Help auth0js , csrf	5	15130	August 30, 2019
Where should the 'state' nonce be generated and checked? Get Help authorization-code-f , state	2	10020	July 25, 2019
Are nonce and state automatically verified? Get Help	1	3537	April 23, 2020
Proper auth0-js state/nonce management? Get Help auth0	1	4754	December 19, 2019