andreareginato/oauth-ng — pull request #34 by jamescrowley (2014-09-26 20:01:39+00:00)
Title: Ignore tokens if the state does not match

In order to protect against cross site request forgery, you should check the state parameter matches the one returned in the fragment.