Hi I was just looking at OAuth2ServerSettings to f...

# ktor

[Sondre H]

Hi I was just looking at OAuth2ServerSettings to figure out how the OAuth feature manages the state in the OAuth2 flow. Looks to me like the state is not verified in the callback from the ID provider. I am new to OAuth but does this not leave users of the features somewhat in risk of a CSRF type attack?