code: protected void checkStateParameter(HttpSession session, Map<String, String[]> parameters)
              throws AuthenticationException {
  
          String originalState = (String)session.getAttribute(oAuth2ServiceProperties.getStateParamName());
          String receivedStates[] = parameters.get(oAuth2ServiceProperties.getStateParamName());
  
          // There should only be one entry in the array, if there are more they will be ignored.
          if (receivedStates == null || receivedStates.length == 0 ||
                  !receivedStates[0].equals(originalState)) {
              String errorMsg = String.format("Received states %s was not equal to original state %s",
                      receivedStates, originalState);
              LOG.error(errorMsg);
              throw new AuthenticationServiceException(errorMsg);
          }
      }
docs: Check the state parameter to ensure it is the same as was originally sent. Subclasses can override this
  behaviour if they so choose, but it is not recommended.
  @param session The http session, which will contain the original scope as an attribute.
  @param parameters The parameters received from the OAuth 2 Provider, which should contain the same state as
  originally sent to it and stored in the http session.
  @throws AuthenticationException If the state differs from the original.