func (c *csrf) HashOIDCNonce() string {
	return encryption.HashNonce(c.OIDCNonce)
}
HashOIDCNonce returns the hash of the OIDC nonce
package cookies
import (
	"errors"
	"fmt"
	"net/http"
	"time"
	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/clock"
	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
	"github.com/vmihailenco/msgpack/v4"
)
type CSRF interface {
	HashOAuthState() string
	HashOIDCNonce() string
	CheckOAuthState(string) bool
	CheckOIDCNonce(string) bool
	SetSessionNonce(s *sessions.SessionState)
	SetCookie(http.ResponseWriter, *http.Request) (*http.Cookie, error)
	ClearCookie(http.ResponseWriter, *http.Request)
}
type csrf struct {
	OAuthState []byte `msgpack:"s,omitempty"`
	OIDCNonce []byte `msgpack:"n,omitempty"`
	cookieOpts *options.Cookie
	time       clock.Clock
}
func NewCSRF(opts *options.Cookie) (CSRF, error) {
	state, err := encryption.Nonce()
	if err != nil {
		return nil, err
	}
	nonce, err := encryption.Nonce()
	if err != nil {
		return nil, err
	}
	return &csrf{
		OAuthState: state,
		OIDCNonce:  nonce,
		cookieOpts: opts,
	}, nil
}
func LoadCSRFCookie(req *http.Request, opts *options.Cookie) (CSRF, error) {
	cookie, err := req.Cookie(csrfCookieName(opts))
	if err != nil {
		return nil, err
	}
	return decodeCSRFCookie(cookie, opts)
}
func (c *csrf) HashOAuthState() string {
	return encryption.HashNonce(c.OAuthState)
}