[modeless]

It's my understanding that the OAuth "state" parameter nonce is generated and stored and validated on the client, not the server.

[loa_in_]

You're right. sorry. There goes me not refreshing my memory about the flow.