# verifyPendingFlow

**Kind:** Function

**Source:** [`atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts#L707)

Validate the authorization response against the flow that started it.

This is the whole point of `state`: without this check any page on the internet could send a
reader to this URL carrying an authorization code of the ATTACKER's account, and the
playground would quietly start acting as them.

## Signature

```ts
function verifyPendingFlow(pending: PendingFlow | null, response: AuthorizationResponse, currentOrigin: string, now): PendingFlow
```

## Parameters

| Name | Type |
|---|---|
| `pending` | `PendingFlow | null` |
| `response` | `AuthorizationResponse` |
| `currentOrigin` | `string` |
| `now` | `any` |

**Returns:** `PendingFlow`