How to verify OAuth state on backend to prevent CSRF with Casdoor JS SDK?

Hi, I try to integrate my backend application with casdoor. I use casdoor js sdk: https://github.com/casdoor/casdoor-js-sdk?tab=readme-ov-file and Python Casdoor SDK. In with way I can verify state on backend? Should I save state in backend session before call casdoor? I can see that sdk.signin method send request with code and state, but how can I verify this state on backend? I see that there is method sdk.getOrSaveState(), but is it secure to use this. I want prevent my app of csrf attack.

I need an advice how implement csrf protection using casdoor, while exchange oauth code to token.

I wonder, how I can check state in backend. As I can see there is method: signin(serverUrl, signinPath), with send code and state to backend, but when I call this I dont have state on backend. I wonder, why this method send state. As I understand, to protect against csrf attack, I should first call endpoint on backend, generate state, save in session, and return cookie with state, and next call to backend for code exchange should contain this state. But I wonder, why that method send state. Maybe I dont understand this flow?

I saw, that method from this sdk: https://github.com/casdoor/casdoor-java-sdk/blob/master/src/main/java/org/casbin/casdoor/service/AuthService.java, getOAuthToken take parametr state, but not use it anymore.

My doubts stem from the fact that the signIn method returns the state to the backend, and there is no way to verify it. I would like to integrate with casdoor in most secure way 🙂

This part of my frontend code: ```import SDK from "casdoor-js-sdk";

const sdk = new SDK({
serverUrl: "https://casdoor-server",
clientId: "id",
appName: "app",
organizationName: "organization",
redirectPath: "/auth",
signinPath: "/api/signin",
});

if (window.location.pathname === "/auth") {
await sdk.signin("http://localhost:8080");
}

window.location.href = sdk.getSigninUrl();and backend:from bottle import request, Bottle

from api.utils.cors import cors_enabled

def setup_auth_routes(app: Bottle):

@app.route('/api/signin', ['POST', 'OPTIONS'])
@cors_enabled
def auth_callback():
    code = request.query.get('code')
    state = request.query.get('state') ```

I can get state param on backend, but how can I validate it? As I understand, I should have this state before call /api/signin in frontend.

ask in Casdoor channel