I am trying to implement the ability for my users to link their Spotify account to their profiles in my app. In Spotify's official API docs, it says that the STATE field should be provided when performing a request on the /authorize endpoint in order to avoid CSRF attacks.
However, I don't quite understand this approach in my particular case. My client-application is a mobile app for iOS which uses JSON Web Tokens for authentication. Only after a correct token has been detected, my server returns the authorization link for the Spotify API to the client, allowing the user to authorize my app. Therefore, CSRF requests aren't really possible, right?
Upon successful authorization, the Spotify api calls a pre-defined callback, attaching the initially provided STATE field as URL query item.
I am wondering if I could just provide the user id of the account making the request so that the success-callback includes a reference to the user account in my database, allowing my server to quickly link the returned access & refresh tokens to it.
However, providing the user id for the STATE field would not comply with the RFC6749 standard as it wouldn't be an opaque value.
Now I would like to ask for advice whether or not I should use the STATE field at all. If so, can I just plug in the user id of the current account as this would simplify things for me or does it have to be a randomly generated value?