The state returned on the redirect didn't match the one this session
generated — either a forged/replayed callback, or a stale tab. Per RFC
6749 §10.12, state exists specifically to bind the callback to the
request that started it and stop cross-site request forgery.
The
statereturned on the redirect didn't match the one this session generated — either a forged/replayed callback, or a stale tab. Per RFC 6749 §10.12,stateexists specifically to bind the callback to the request that started it and stop cross-site request forgery.