What is the difference between the state and the nonce parameter in OpenID Connect?
state protects the redirect (callback) step: the RP checks that the response returning to its redirect URI belongs to a request it started, which blocks CSRF. nonce protects the ID token: the OP copies it into the token, and the RP checks it to bind the token to its session and reject replays.
Both are random values the RP generates and remembers (for example in a cookie bound to the user's browser session), but they are checked at different places:
state |
nonce |
|
|---|---|---|
| Returned in | The authorization response URL (...cb?code=...&state=...) |
The nonce claim inside the signed ID token |
| Checked when | The browser arrives at the redirect URI | The RP validates the ID token |
| Defends against | CSRF on the callback: an attacker making the victim's browser deliver the attacker's code | Replay or injection of an ID token from another session |
| Origin | OAuth 2.0 | OpenID Connect |
Why both: state is just echoed in a URL and is not cryptographically tied to any token, so it says nothing about whether a given ID token belongs to this session. nonce sits inside the signed token, so the attacker cannot change it, but it is only checked once the token is in hand. Together they cover the callback and the token.
Go deeper:
OpenID Connect Core 1.0: Nonce Implementation Notes — how to generate and bind a nonce to the browser session.- RFC 9700, Section 4.7: Cross-Site Request Forgery — the CSRF attack on the redirect and the roles of
state, PKCE andnonce.