I think I am misunderstanding the OAuth OpenID Connect specification and here's why:
I try to implement "Sign in with Apple". You can opt to use a popup or a redirect to an apple page I want to keep it simple at first, so I am using the redirect options. Clicking the "Sign in with Apple" button will redirect me to the apple sign in page having the state filled to prevent CSRF attacks.
After successful authentication, apple "redirects" to my specified redirect url by making a POST request to that URL with the state, code and id_token value.
Now here's the thing: How am I supposed to validate the state, when the POST request originated from a different session? I send a CSRF-Token as the state from the user who clicked on the "Sign in with Apple" button but the response from apple was made as a different session – having a different CSRF-Token.
Am I even supposed to validate the state in this kind of flow? I feel that I have to otherwise someone could just use CSRF to send a POST request to my redirect URL with an arbitrary code and id_token.
Anyone knows how to validate the state? I'd appreciate the help :D Thanks in advance.
Addition: With the popup option everything should work, I receive state, code and id_token in a browser event after successful authentication so I can validate that the state and the nonce both match.