Enforce oauth state parameter validation
Configure the glide.oauth.state.parameter.required property to prevent your instance from cross-site request forgery (CSRF) attacks.
The glide.oauth.state.parameter.required system property enables the State parameter to be required in an OAuth request for authorization code flow. Beginning in the Madrid release, the system property glide.oauth.state.parameter.required adds a State parameter for an OAuth request. For zbooted instances, the property is true. For upgraded instances, the property is not present, so the State parameter is not enabled. The State parameter is a string value, and should not contain special characters. The State parameter cannot be empty or " ". Not setting the State parameter to true ensures that an attacker cannot perform CSRF attacks during authentication can allow an attacker to perform operations as the victim.
Ensure that the property glide.oauth.state.parameter.required is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.oauth.state.parameter.required |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | false |
| Category | Access control |
| Security risk |
|
| Functional impact | None |
| Dependencies and prerequisites | None |
Parent Topic:Access control