T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:130- Finding
Static OAuth State Enables Login CSRF and Session Misbinding
- Content
View full analysis
dict: resp = requests.post('https://api.figma.com/v1/oauth/token', data={ 'client_id': CLIENT_ID, 'client_secret': CLIENT_SECRET, 'redirect_uri': REDIRECT_URI, 'code': auth_code, 'grant_type': 'authorization_code' }, timeout=30) resp.raise_for_status() return resp.json() ``` ### Technical Analysis The OAuth authorization URL uses the constant value `random_state_string` for the `state` parameter. The template does not generate a cryptographically random state value, associate it with the initiating user session, or demonstrate validation of the returned state before exchanging the authorization code. OAuth state is intended to bind an authorization response to the browser session that initiated the flow. A fixed, publicly known value provides no meaningful request correlation or CSRF protection. If an application follows this template, its callback may process an unsolicited authorization response and associate the resulting Figma identity with the wrong application session. The flagged token exchange request sends an authorization code and client secret to the official Figma HTTPS API. That transmission is necessary for the declared OAuth functionality and is not evidence of unrelated exfiltration. The vulnerability is the missing secure state lifecycle around the request. ### Attack Path 1. An attacker begins the Figma OAuth authorization flow using the target application's client identifier and ...[truncated 1491 chars]- Remediation
View remediation