title: Azure Active Directory session_state
body: <p>I'm using Azure Active Directory to authenticate my users and this is the url that I redirect the users to:</p>
  
  <pre><code>https://login.windows.net/common/oauth2/authorize?response_type=id_token&amp;redirect_uri=https%3A%2F%2Ftest.com%2F&amp;client_id=CB08A120-12BD-11E4-8143-DA6DD34483DE&amp;scope=openid&amp;response_mode=form_post&amp;nonce=50b4146c-585c-49e5-a78e-56d9685c56f2
  </code></pre>
  
  <p>The response I get comes in the form of a post and has these two parameters:</p>
  
  <pre><code>id_token=*
  session_state=*
  </code></pre>
  
  <p>However, I'm not exactly sure what <code>session_state</code> is. I've tried looking through the documentation, but can't seem to find a good answer. The places where I've found <code>session_state</code> in the documentation are <a href="http://msdn.microsoft.com/en-us/library/azure/dn645542.aspx" rel="nofollow">here</a> and <a href="https://github.com/nordvall/TokenClient/wiki/OAuth-2-Authorization-Code-grant-in-AzureAD" rel="nofollow">here</a>, but neither one helped very much. Is the <code>session_state</code> something I should be persisting in a cookie and sending to each future request to Azure? Or what is its purpose and the proper way to handle it?</p>