According to the docs at https://www.godoc.org/golang.org/x/oauth2#Config.AuthCodeURL
...State is a token to protect the user from CSRF attacks. You must always provide a non-zero string...
and at http://tools.ietf.org/html/rfc6749#section-10.12
...any request sent to the redirection URI endpoint to include a value that binds the request...
Yet this is specifically at the part in the flow when there is no session data, i.e. the user has not logged in and the auth code is only generated upon showing the anonymous page.
How then can this value be randomized and compared upon callback? Is it a static value randomized per server?
state
RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in Section 10.12.
You use state to identify that the callback from the authorization server matches the request sent. If there wasn't state a attacker could just call your callback url with a random access token that you didn't request. With state you know that the called callback is in response to the request you made.
So you randomize state per request that you sent and track it until you receive the matching callback. It can be anything you want as long as it can't be guessed.
A simple approach would be leveraging rand.Reader and base64 encoding the result:
func state(n int) (string, error) {
data := make([]byte, n)
if _, err := io.ReadFull(rand.Reader, data); err != nil {
return "", err
}
return base64.StdEncoding.EncodeToString(data), nil
}