Yup, you can use it for CSRF.

From [FB docs](https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/):
*state: An arbitrary unique string created by your app to guard against Cross-site Request Forgery.*