How to get rid of default OAuth Callback Forgery?

Question

Ruby on Rails

homakov.blogspot.com/2012/07/saferweb-most-common-oauth2.html
who would solve the problem without leaving the parameter optional?

Answer 1

This article describes the solution.
You are supposed to send special optional param 'state' - any random hash you get back by Provider in User's callback: ?code=123&state=HASH. Before adding OAuth account you MUST verify session[state] is equal params[state].