title: How does state get encoded or encrypted in Spring OAuth2?
body: <p><strong>How specifically is the <code>state</code> parameter related to the <code>_csrf</code> token in Spring OAuth2?</strong>  Is <code>state</code> an encrypted version of <code>_csrf</code> as we would expect it to be?</p>
  <p><strong>Also, what specific Java syntax should be used to encode and encrypt a new <code>_csrf</code> value before encapsulating it into a new <code>state</code> parameter in Spring OAuth2?</strong></p>
  <h3>THE CONTEXT</h3>
  <p>A client app redirects the user's web browser from the client app to the authorization server's authserver/login page.  Then, in the authorization server app, a custom implementation of <a href="http://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/filter/OncePerRequestFilter.html" rel="nofollow noreferrer"><code>OncePerRequestFilter</code></a> is used to redirect a request to <code>/oauth/authorize?(list of params)</code> into additional authentication steps, which ultimately redirect back into a new request to <code>/oauth/authorize?(list of params)</code>.   The problem is that <strong>the <code>_csrf</code> token changes during the additional authentication steps</strong>, and <a href="https://www.rfc-editor.org/rfc/rfc6749#section-10.12" rel="nofollow noreferrer">the documentation indicates that <code>_csrf</code> is used as the <code>state</code> parameter</a>.  This implies that <strong>the <code>state</code> value probably needs to be updated by the authorization server to reflect the new <code>_csrf</code> value</strong>.</p>
  <h3>HOW <code>state</code> IS GENERATED</h3>
  <p>The problem is that the encoded and encrypted value for <code>state</code> has already been set by the client app before the client app uses an <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java" rel="nofollow noreferrer"><code>OAuth2ClientAuthenticationProcessingFilter</code></a> to transfer information for the authentication server to use while authenticating the user via the authentication steps mentioned above.</p>
  <p>Some research indicates that the <code>state</code> key is generated by the client using a <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java" rel="nofollow noreferrer"><code>DefaultStateKeyGenerator</code></a>, which in turn uses a <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java" rel="nofollow noreferrer"><code>RandomValueStringGenrator</code></a> to generate a 6 character state value.</p>
  <p>For example, <strong>in the original request made to <code>/oauth/authorize?(list of params)</code>, the raw <code>_csrf</code> value is encoded into <code>fupS1L</code></strong>, as shown in the following url:</p>
  <pre><code>/oauth/authorize?client_id=acme&amp;redirect_uri=http://localhost:8080/login&amp;response_type=code&amp;state=fupS1L
  </code></pre>
  <p>If the <code>_csrf</code> value changes to <code>a69fd23a-a393-4b27-a685-a323fd31db9a</code> during the redirect flow, the value of <code>fupS1L</code> in the state parameter will no longer be valid, and the resulting token will not be authorized to permit access to protected resources.</p>
  <p><strong>What specific syntax do I use in order to convert the new <code>_csrf</code> value into an encrypted value similar to <code>fupS1L</code> that can be passed into a functional <code>state</code> parameter?</strong></p>
  <p>Also, is there any relationship between the <code>state</code> variable and the <code>_csrf</code> token?  The <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java" rel="nofollow noreferrer"><code>RandomValueStringGenerator</code></a> used by <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java" rel="nofollow noreferrer"><code>DefaultStateKeyGenerator</code></a> seems to simply create a random 6 character String.  I would like an authoritative answer by someone who has worked deeply with the code or even written it.  I am doing a deep review of the code, so a casual passer by who reads the <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java" rel="nofollow noreferrer"><code>RandomValueStringGenerator</code></a> source code and says state is not related to the <code>csrf</code> token would not be adding any value.  The author of the API, however, would help us all out a lot by telling us how this works.</p>
  <h3>NOTE TO SPRING</h3>
  <p>It should not require this much digging to find documentation of such a simple thing.</p>