From 4644a7d3f481e14c31fa36ceeebcf66807f2802c Mon Sep 17 00:00:00 2001
From: Gregory Wells <gawells@astraltech.xyz>
Date: Thu, 6 Aug 2026 14:37:53 -0400
Subject: [PATCH] Handle state in OAuth client

---
 auth/oauth_callback.go | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/auth/oauth_callback.go b/auth/oauth_callback.go
index 98379fe..106a02e 100644
--- a/auth/oauth_callback.go
+++ b/auth/oauth_callback.go
@@ -7,5 +7,25 @@ import (
 
 // this is usually served at /callback
 func OAuthCallback(w http.ResponseWriter, r *http.Request) {
-	fmt.Printf("Getting my OAuth callback")
+	state := r.FormValue("state")
+	code := r.FormValue("code")
+
+	stateCookie, err := r.Cookie("oauth_state")
+	if err != nil {
+		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
+		return
+	}
+	if state != stateCookie.Value {
+		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
+		return
+	}
+
+	http.SetCookie(w, &http.Cookie{
+		Name:   "oauth_state",
+		Value:  "",
+		Path:   "/",
+		MaxAge: -1,
+	})
+
+	fmt.Printf("Handling some OAuth, %s\n", code)
 }