First, just don't enable implicit grant. That makes it a lot harder to screw up.

State is for preventing CSRF, not transferring data. Don't abuse state, it's wrong.

Use your own authorize url, add an encrypted cookie and redirect to the real one. Even if the cookie is encrypted, only put some kind of session/cache key in it, don't actually send "info". Read cookie in callback then delete it.