Whether a callback's state matches what was stored, in constant time and within the TTL.
A mismatched state is CSRF: an attacker completes a login with their own authorization code in
the victim's browser, and the victim ends up signed in as the attacker.
Whether a callback's
statematches what was stored, in constant time and within the TTL.A mismatched
stateis CSRF: an attacker completes a login with their own authorization code in the victim's browser, and the victim ends up signed in as the attacker.