state parameters

[Vitalii Kikh]

Hi all,
Where I can find  state parameters for authorization request? 

Thanks

[Fenil Desani (Cerner)]

Hello,

State parameter needs to be defined by the Application.

http://fhir.cerner.com/authorization/

When performing an authorization grant request, it is highly recommended that your client application establish a transient, one-time-use “state” value for each individual request you send. If your application receives an authorization response that does not include a value known to the current user’s device, it should reject the response. This mechanism is to protect your application against “cross-site request forgery” classes of exploits. For more information on these types of exploits, consult the RFC OAuth 2.0 Threat Model and Security Considerations.

Thanks,

Fenil (Cerner)

[Vitalii Kikh]

"State parameter needs to be defined by the Application."   

Do you mean SmartApplication on https://code.cerner.com/?

пʼятниця, 21 травня 2021 р. о 18:17:16 UTC+3 Fenil Desani (Cerner) пише:

[Fenil Desani (Cerner)]

Yes, that's correct! Your Application needs to send the state param while making the Auth requests!