state parameter is recommended with oauth2 authentification
to mitigate CSRF attacks (see [1]).
hydra [2] will throw the following error message if state is
missing:
description="The state is missing or has less than 8 characters and is therefore considered too weak" error=invalid_state hint="Request
parameter \"state\" must be at least be 8 characters long to ensure sufficient entropy."
[1]: https://auth0.com/docs/protocols/oauth2/oauth-state
[2]: https://www.ory.sh/hydra/
Signed-off-by: Samuel Trégouët <samuel.tregouet@gmail.com>
this preverted changes made in 7b8576d. now we use hooks to hash password.
no need to call User.hashPassword() manually.
Signed-off-by: BinotaLIU <me@binota.org>
Michal Kolodziejski
James Tsai
Samuel Trégouët
BinotaLIU
moycat
BoHong Li