OAuth state parameter
A random value sent out and checked on return so an OAuth callback belongs to the same browser login attempt.
What it is
The OAuth `state` parameter is a random value your app puts in the authorization request and expects back unchanged at the callback. It binds that response to the browser that started the flow, which helps stop login CSRF and authorization responses being planted in someone else's session.
Generate a fresh, unpredictable state for every attempt and keep the expected value in a short-lived server-side login transaction or a protected correlation cookie. It can point to stored context such as the page to return to after login, but that context should be validated rather than trusting a URL supplied by the browser.
The gotcha is treating state as decorative. Reject the callback before the code exchange if state is missing, expired, already used, or does not match. State is not the OIDC nonce and not the PKCE verifier: state binds the browser flow, nonce binds an ID token, and PKCE binds the authorization code to its initiating client.
Ask AI for it
Protect the OAuth callback with a one-time state value. In Node.js, generate 32 random bytes with `crypto.randomBytes(32)`, encode them as base64url, and store the value with the initiating session, a five minute expiry, and a validated post-login path. Include it as the `state` parameter in the authorization request. On callback, require an exact match before exchanging the code, consume the record atomically so it cannot be replayed, and return a generic login failure for missing, expired, or mismatched state. Keep OIDC `nonce` and the PKCE code verifier as separate random values, and never place an unvalidated external redirect URL inside state.