Full threadgerardnico·It should not happen if you have a proper state that is local, unknown from the attacker and temporarily valid.https://datacadamia.com/iam/oauth/stateView on HN