title: Openid - Is there a way to get the state & nonce generated by Challenge method without redirection?
body: <p>I have a requirement to integrate with an external authentication provider which they require us to generate the state &amp; nonce and using these parameters as an input for the embedded JS to generate the QR code, this QR code will be scanned by mobile for authentication.</p>
  <p>for the standard login with external authentication provider, we call the Challenge() method to redirect to the login page, and the redirect url contains the state &amp; nonce itself, is there a way to generate/get them without redirection?</p>
  <p>If I generate random nonce &amp; state at frontend side then scanning the QR code and completed the authentication in mobile, it returned the authentication code and threw &quot;unable to unprotect the message.State.&quot; exception at the IS4, I tried to disable the state validation but it does not work.</p>
  <pre><code>configureOptions.ProtocolValidator = new OpenIdConnectProtocolValidator()
  {
      RequireState = false,
      RequireStateValidation = false,
  };
  </code></pre>
  <p>Any help would be much appreciated.</p>