From a33d2da62102327827eff9f1a73e1c021f59201e Mon Sep 17 00:00:00 2001
From: Nikita <nik1004@gmail.com>
Date: Thu, 26 Sep 2019 17:38:25 +0300
Subject: [PATCH] state param fix

---
 example.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/example.php b/example.php
index 1c2c378..7e3d368 100644
--- a/example.php
+++ b/example.php
@@ -26,7 +26,7 @@
          * Просто отображаем кнопку авторизации или получаем ссылку для авторизации
          * По-умолчанию - отображаем кнопку
          */
-        $_SESSION['oauth2state'] = $provider->getState();
+        $_SESSION['oauth2state'] = bin2hex(random_bytes(16));
         if (true) {
             echo '<div>
                 <script
@@ -49,7 +49,7 @@ class="amocrm_oauth"
             </script>';
             die;
         } else {
-            $authorizationUrl = $provider->getAuthorizationUrl();
+            $authorizationUrl = $provider->getAuthorizationUrl(['state' => $_SESSION['oauth2state']]);
             header('Location: ' . $authorizationUrl);
         }
     } elseif (empty($_GET['state']) || empty($_SESSION['oauth2state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {