2. Verify the state parameter

You have now been redirected back to the application, to the page that was specified in the redirect-url parameter. In the URL you can notice, that there are addtional query parameters:

Let's break it down...

• state=

  The state parameter is an opaque value used by the client to maintain state between the request and the callback. Essentially, it is used to prevent Cross-Site Request Forgery (CSRF) attacks and to ensure the response belongs to the request made by the client.

• code=

  The code parameter contains the actual authorization code. This is a temporary code that the client can exchange for an access token (and optionally, a refresh token) by making a back-channel request to the Authorization Server. The format and structure of the code is determined by the Authorization Server. It can be just a random string, or a more complex construction. The exact significance of this structure is specific to the Authorization Server implementation and might include different identifiers or information encoded in the structure.

Now we have everything necessary to obtain token for the user. But is the state we have sent equivalent to the one we received back?