protected boolean checkOauth2LoginState(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        String state = req.getParameter("state");
        String sessionState = (String) req.getSession().getAttribute("oauth2_login_state");
        if(!Strings.equals(sessionState,state)){
            return false;
        }
        return true;
    }
protected boolean checkOauth2LoginState ( HttpServletRequest req , HttpServletResponse resp ) throws IOException { String state = req . getParameter ( "state" ) ; String sessionState = ( String ) req . getSession ( ) . getAttribute ( "oauth2_login_state" ) ; if ( ! Strings . equals ( sessionState , state ) ) { return false ; } return true ; }
OAuth登录过程需要校验<code>state</code>参数是否变化。

默认情况下这个<code>state</code>是调整到SSO登录时生成的随机码，如果这个状态被改变说明请求可能被篡改。

校验通过返回<code>true</code>，不通过返回false。

@see #setOauth2LoginState(HttpServletRequest, HttpServletResponse, String)