Patched code sample

import os
from starlette.applications import Starlette
from starlette.middleware import Middleware
from starlette.middleware.sessions import SessionMiddleware
from starlette.responses import JSONResponse
from starlette.routing import Route
from authlib.integrations.starlette_client import OAuth

# The vulnerability was that Authlib did not use the session to store the
# OAuth state parameter, creating a CSRF risk. The fix involves using
# the session, which requires the SessionMiddleware to be configured.
# This example demonstrates the correct, fixed usage.

# A real secret key should be used in production.
app_secret_key = os.urandom(24)

# 1. Initialize OAuth registry
oauth = OAuth()

# 2. Register a remote application
# NOTE: In a real app, load these from environment variables or a config file.
oauth.register(
    name='google',
    client_id='YOUR_CLIENT_ID',
    client_secret='YOUR_CLIENT_SECRET',
    server_metadata_url='https://accounts.google.com/.well-known/openid-configuration',
    client_kwargs={'scope': 'openid email profile'}
)

# 3. Define the login route that initiates the OAuth flow
async def login(request):
    redirect_uri = request.url_for('auth')
    # The fixed version of this method now stores a CSRF 'state' token
    # in the user's session (request.session).
    return await oauth.google.authorize_redirect(request, redirect_uri)

# 4. Define the callback route that handles the response from the provider
async def auth(request):
    # The fixed version of this method retrieves the 'state' from the session
    # and compares it with the 'state' parameter in the callback URL,
    # preventing CSRF attacks.
    try:
        token = await oauth.google.authorize_access_token(request)
    except Exception as e:
        return JSONResponse({'error': str(e)})

    user = await oauth.google.parse_id_token(request, token)
    return JSONResponse({'token': token, 'user': user})

# 5. Create the Starlette application with routes and the crucial SessionMiddleware
routes = [
    Route('/login', endpoint=login),
    Route('/auth', endpoint=auth),
]

# The SessionMiddleware is required for the CSRF fix to work, as the 'state'
# is stored in the session.
middleware = [
    Middleware(SessionMiddleware, secret_key=app_secret_key)
]

app = Starlette(routes=routes, middleware=middleware)

# To run this example:
# 1. Install dependencies: pip install "uvicorn[standard]" "authlib>=1.3.0" "starlette" "requests"
# 2. Replace 'YOUR_CLIENT_ID' and 'YOUR_CLIENT_SECRET' with your credentials.
# 3. Run with uvicorn: uvicorn your_file_name:app --reload
# 4. Access http://127.0.0.1:8000/login in your browser.