The state you generated for this authorization request and stored against the user's session.
Checked before anything else. This is what stops an attacker from replaying someone else's callback into your
session, and it only works if the value is unguessable and bound to that one user.
The
stateyou generated for this authorization request and stored against the user's session.Checked before anything else. This is what stops an attacker from replaying someone else's callback into your session, and it only works if the value is unguessable and bound to that one user.