Validate OAuth state parameter on Google login callback

[RUKAYAT-CODER]

Background

The Google OAuth callback does not verify the state nonce, allowing login CSRF. Generate and validate a state value.

Files to modify (2-3)

src/lib/google/oauth.ts
src/middleware/security.ts

Acceptance Criteria

Implemented across the listed files

Unit/integration tests added or updated and passing

No regression; follows project coding standards

[Olumide-01]

@Olumide-01 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I would like to work on this issue because I understand the problem and have a clear approach to solving it. Please assign to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Olumide-01 to this issue.

[solaoye187-lab]

@solaoye187-lab has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer kindly assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @solaoye187-lab to this issue.

[De-wahab001]

@De-wahab001 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I’ve reviewed the issue and understand the login CSRF risk caused by the Google OAuth callback not validating the state nonce. I can implement secure state generation and validation across the OAuth and security middleware flow, add the necessary unit/integration tests, and verify there are no regressions while following the project’s existing patterns. I’d be happy to take this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @De-wahab001 to this issue.

[ZuLu0890]

@ZuLu0890 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to resolve this issue and give it a higher quality PR

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ZuLu0890 to this issue.

[cristinadnicholson-pixel]

@cristinadnicholson-pixel has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Please assign this to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @cristinadnicholson-pixel to this issue.

[DevScoopee]

@DevScoopee has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I fully understand what needs to be done and can deliver. Kindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DevScoopee to this issue.

[Hasmong]

@Hasmong has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello, I’m interested in taking on this issue. After reviewing the requirements, I’m confident I can implement the necessary changes and deliver a quality contribution.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hasmong to this issue.

[solaawojobi00-bit]

@solaawojobi00-bit has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I’d like to claim this issue!
I’ll implement OAuth state parameter generation and validation for Google login in rinafcode/teachLink_web to protect against login CSRF attacks.
To resolve this issue, I will:

• State Nonce Generation & Validation: Update src/lib/google/oauth.ts and src/middleware/security.ts to generate a cryptographically secure state nonce during login initiation, store it securely (e.g., in session/cookie), and validate it upon callback handling.
• Error Handling: Reject login callback requests with missing, invalid, or mismatched state parameters before granting authentication tokens.
• Testing: Add unit and integration tests to verify state parameter generation during authorization, successful authentication with valid states, and rejection of invalid/tampered state nonces.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @solaawojobi00-bit to this issue.

[chukwunazannakenyi-netizen]

@chukwunazannakenyi-netizen has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @chukwunazannakenyi-netizen to this issue.

[pharwasz]

@pharwasz has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I would like to work on this issue kindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @pharwasz to this issue.

[timilehin01010-byte]

@timilehin01010-byte has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I would like to fix this issue
Thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @timilehin01010-byte to this issue.

[danielchukuma-dev]

@danielchukuma-dev has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer,i have vast experience on this issue, can you assigned it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @danielchukuma-dev to this issue.

[sherifatolanike]

@sherifatolanike has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I'd like to work on this issue. I'm confident I can make the necessary implementation to ensure the it meets the acceptance criteria.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sherifatolanike to this issue.