title: What attack does the "state" parameter in OpenID Connect server flow prevent?
body: <p>Not sure what kind of CSRF attack prevents the "state" parameter in OpenID Connect server flow. Could someone give me an example?</p>