HUMAN VERIFICATION REQUIRED ASVS 10.2.1 Code-flow CSRF defense (when oauth_oidc is used)

If the code flow is used, the OAuth client has protection against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF), which trigger token requests, either by using proof key for code exchange (PKCE) functionality or checking the 'state'parameter that was sent in the authorization request.