title: Xamarin.Auth with facebook results in state - Explicit flow
body: <p>I'm implementing facebook login using the Xamarin.Auth component. I request a login by my backend (aspnet webapi) which returns a challenge result and my app gets a redirect to facebook login. At the same time of the redirect I also get a popup in the app saying "Invalid state from server. Possible forgery!" found it here in the source <a href="https://github.com/xamarin/Xamarin.Auth/blob/master/src/Xamarin.Auth/OAuth2Authenticator.cs" rel="nofollow">https://github.com/xamarin/Xamarin.Auth/blob/master/src/Xamarin.Auth/OAuth2Authenticator.cs</a></p>
  
  <p>If I investigate the request I can see a state is generated in the OAuth2Authenticator class.</p>
  
  <p>My question, is the best way to handle authentication in the current setup or should I avoid to let my own backend redirect the app login. Instead let the app login directly with facebook and the send the token from facebook to my backend, where I'll verify it with a call to <a href="https://graph.facebook.com/me" rel="nofollow">https://graph.facebook.com/me</a> and then generate my own auth_token if the call is valid?</p>
  
  <p>I just read Instagram login docs <a href="https://www.instagram.com/developer/authentication/" rel="nofollow">https://www.instagram.com/developer/authentication/</a></p>
  
  <p>And it's exactly what I meant, Implicit or Explicit flow. For me Explicit is not working with Xamarin.Auth against facebook, due to the state. </p>
  
  <p>Best regards</p>