CSRF state (RFC 6749 §10.12): an unguessable per-request nonce, echoed
back on the redirect and checked in parseAuthorizationCallback. 16 random
bytes (128 bits) is standard nonce entropy — there is no RFC-mandated
length for state, unlike code_verifier.
CSRF
state(RFC 6749 §10.12): an unguessable per-request nonce, echoed back on the redirect and checked inparseAuthorizationCallback. 16 random bytes (128 bits) is standard nonce entropy — there is no RFC-mandated length forstate, unlikecode_verifier.