title: Laravel Socialite in "stateless" mode -- security implications?
body: <p><a href="https://github.com/laravel/socialite" rel="noreferrer">Laravel Socialite</a> has a "stateless" mode which disables storing anything to session. From a read of the source code it doesn't do anything different instead -- it just doesn't store or retrieve these values.</p>
  
  <p>As part of this, it <a href="https://github.com/laravel/socialite/blob/c4e4337e5b70149fdbefbb95b2c9e93d0749c413/src/Two/AbstractProvider.php#L234" rel="noreferrer">assumes</a> for example that the OAuth state is always valid.</p>
  
  <p>Checking this is one of the things which the <a href="https://dev.twitter.com/web/sign-in/implementing" rel="noreferrer">Twitter sign-in documentation</a>, for example, tells us to do.</p>
  
  <p>So I'm wondering what sort of security implications using the stateless mode of Socialite could have.</p>
  
  <p>If it's anything serious, what sort of workarounds would there be, for an application running as a stateless API? I could store things in its Redis store, but I'm not sure how I'd tie any bit of information to the current user. By reimplementing what Socialite does I could for example store the state in the cache, keyed by some hash of the user's IP and browser fingerprint. But this seems very messy.</p>