Improve state passing #11
Description
Form options (CSV/JSON) are currently passed through the OAuth state string parameter. This complicates passing state and is nonstandard. Instead, we should be storing this state locally with the state token as a key (and ideally validating the request):
If state is used for carrying application state, and integrity of its contents is a concern, clients MUST protect state against tampering and swapping. This can be achieved by binding the contents of state to the browser session and/or signed/encrypted state values
See:
- https://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state-09
- http://www.thread-safe.com/2014/05/the-correct-use-of-state-parameter-in.html
- https://stackoverflow.com/questions/52459476/does-oauth-state-mitigate-any-genuinely-dangerous-attacks
- https://pipedrive.readme.io/docs/marketplace-oauth-authorization-state-parameter