Canvas Studio OAuth authorization does not send `state` parameter to callback
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-28-2024
10:59 AM
I am working on an integration that uses the Canvas Studio API. In testing this API I have encountered an issue that the `state` query parameter which is passed to the authorization endpoint (`/api/public/oauth/authorize`), is not returned to the callback after a successful authorization on the Canvas Studio side. This parameter is a standard part of the OAuth spec [1] and is used to prevent CSRF. We also use it to persist information about the origin of the request.
[1] https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
