How does CSRF work without state parameter in OAuth2.0?
<p>I use OAuth2.0 of identityserver3 for SSO in company, I cannot understand how does the state parameter prevent the CSRF.</p>

<p><strong>I have copied the attack flow as below:</strong></p>

<p>1.Mallory visits some client's website and starts the process of authorizing that client to access some service provider using OAuth</p>

<p>2.The client asks the service provider for permission to request access on Mallory's behalf, which is granted </p>

<p>3.Mallory is redirected to the service provider's website, where she would normally enter her username/password in order to authorize access</p>

<p>4.Instead, Mallory traps/prevents this request and saves its URL(Callback Url)</p>

<p>5.Now, Mallory somehow gets Alice to visit that URL. If Alice is logged-in to the service provider with her own account, then her credentials will be used to issue an authorization code</p>

<p>6.The authorization code is exchanged for an access token</p>

<p>7.Now Mallory's account on the client is authorized to access Alice's account on the service provider</p>

<hr>

<p>I can understand step 1 to step 4. But from step 5 I got some confusion. Accordding to my understanding, in step 5 Alice visit the Callback Url when she is logged-in, and then the server just use the authorization code to access the OAuth service provider to get an openid and access token in backend, and then Alice's browser just executing login with Mallory's account and access token.What is the relationship with Mallory's browser? 
Could you explain it in detail please? Thank you for taking time to read my word!</p>