Handle state in OAuth client

auth/oauth_callback.go

@@ -7,5 +7,25 @@ import (
 
 // this is usually served at /callback
 func OAuthCallback(w http.ResponseWriter, r *http.Request) {
-	fmt.Printf("Getting my OAuth callback")
+	state := r.FormValue("state")
+	code := r.FormValue("code")
+
+	stateCookie, err := r.Cookie("oauth_state")
+	if err != nil {
+		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
+		return
+	}
+	if state != stateCookie.Value {
+		http.Error(w, "Invalid state parameter", http.StatusBadRequest)
+		return
+	}
+
+	http.SetCookie(w, &http.Cookie{
+		Name:   "oauth_state",
+		Value:  "",
+		Path:   "/",
+		MaxAge: -1,
+	})
+
+	fmt.Printf("Handling some OAuth, %s\n", code)
 }