CORS error persists in oAuth even after setting header

[BarryCarlyon]

@Dist

If by state you mean things like what page the user is currently on, or some non-persistent data, you could encode that into the state param in Step 1, and when the user is returned to your redirect URL it’ll include that same state param, allowing you to decode whatever state data you put there. This allows for things like if a user tried to load /some/path, but wasn’t logged in, you could store that in the state and when they get back you can return them to /some/path.

But a state should still be unique between oAuth requests to prevent CSRF attacks