A school-district parent portal starts an authorization-code grant but omits the state parameter. Which protection is missing from that grant step?
Select an answer to reveal the explanation.
Short Explanation
State is the secret handshake sticker you put on the outbound letter and demand back unchanged. If a stranger forges a return with some other code, the missing or wrong sticker gives them away.
Full Explanation
The client sends an unguessable state to the authorization endpoint and requires the same value on the redirect. That binds the callback to the original request and blocks forged redirects that inject another code. Omitting state is a defect in the grant steps; it is not a full OWASP deep-dive and does not replace other token protections.