---
title: "Security Considerations"
slug: "security-considerations"
updated: 2024-04-04T07:29:52Z
published: 2024-04-04T07:29:52Z
canonical: "docs.connect.visma.com/security-considerations"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.connect.visma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Considerations

Good implementations make use of state and nonce parameters to prevent attacks e.g. state parameter used to tie it to the browser (prevent CSRF attack):

1. User visits OAuth application (signed out)
2. Application sets secure cookie with a state value (cookies are set to the Apps host)
3. Application redirects to Visma Connect IdP with state parameter in the Authorize-request
4. User logs in with Visma Connect IdP
5. Visma Connect IdP redirects back to Application via pre-registered OAuth redirectURI
6. Application validates OAuth state, comparing cookie value to state value from Visma Connect IdP callback
7. Application approves or rejects OAuth callback