Security Enhancement of OAuth Flow

[hupili]

• Use of "state" value (a random string included in authorization request). e.g. renren.
• Use "state" to maintain session in an asynchronous fashion. This is essential in multi-platform authorization. Current solution (See "SNSRouter" project) is a dirty trick to avoid concurrent authorization...

Refs:

• http://photo.weibo.com/2989984215/wbphotos/large/photo_id/3510517514075407?refer=weibofeed
• http://zone.wooyun.org/content/1562
• http://zone.wooyun.org/content/1088