Fix OAuth state parameter security vulnerability

[ghostwriternr]

Replace OAuth client_id values in state parameters with secure random tokens to prevent CSRF attacks and state prediction vulnerabilities.

The current implementation exposes the OAuth client_id directly in the state parameter, making it predictable and potentially enabling cross-site request forgery attacks.

Solution

Replace state parameter with secure random tokens while storing clientId separately:

// Before: Predictable state value
authUrl.searchParams.append("state", client_id);

// After: Secure random token
const stateToken = nanoid();
authUrl.searchParams.set("state", stateToken);
this._clientId_ = client_id; // Store separately

Update callback handler to read clientId from stored property instead of state parameter, with fallback to legacy behavior for backward compatibility.

References

• OAuth 2.0 Security BCP: RFC 6819 - State parameter should be unguessable random values to prevent CSRF attacks
• OWASP OAuth Guidelines: State parameters should be cryptographically random

Supports both static and dynamic client registration flows while maintaining backward compatibility.

[changeset-bot]

🦋 Changeset detected

Latest commit: dd8c7d1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agents	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/agents@521

commit: dd8c7d1

[threepointone]

Changeset