Question

How did the ‘state’ come into GET at facebook auth at http://developers.facebook.com/docs/authentication/? At the code that comes after the “The following PHP example demonstrates the server-side flow with CSRF protection in one self-contained example:”, line if($_REQUEST['state'] == $_SESSION['state']) { . I don’t understand how come that part of the session is transmitted somewhere else.

See related questions: Will the auth work without state at the SESSION?

Answer 1

The state came into the Get via this code:

 $_SESSION['state'] = md5(uniqid(rand(), TRUE)); //CSRF protection
 $dialog_url = "http://www.facebook.com/dialog/oauth?client_id=" 
   . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
   . $_SESSION['state'];