Home/ Questions/Q 8160819
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T18:21:46+00:00

I have been using DotNetOpenAuth v3.5.0.10357 for about a year now and finally decided

  • 0

I have been using DotNetOpenAuth v3.5.0.10357 for about a year now and finally decided to upgrade to v4.0.1.12097. In doing so, I noticed the RequestUserAuthorization method no longer accepts a state parameter.

//v3.5.0.10357
WebServerClient:RequestUserAuthorization(IEnumerable<string> scope = null, string state = null, Uri returnTo = null);

//v4.0.1.12097
WebServerClient:RequestUserAuthorization(IEnumerable<string> scope = null, Uri returnTo = null);

Facebook documentation, mentions this helps guard against Cross-site Request Forgery. What was the reasoning for the removal?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Well, after a bit more digging I found out why it was removed. DotNetOpenAuth does state checking internally (EndUserAuthorizationRequest.ClientState), leaving one less thing for us to worry about. Nicely done!

    • 0