Implement oauth state attribute

[doapp-ryanp]

use state attr if defined, otherwise default to current location. QS params were also not encoded.

[jaspernbrouwer]

This would indeed cover various cases of using the state property. +1

[andreareginato]

Hi @doapp-ryanp, thanks a lot for your contribute. Much more appreciated. I would love to ask two more thing:

• README section where you can see how to use state to solve security problems.
• Tests for the new additions.

[doapp-ryanp]

No - thank you for the work on this wonderful plugin.

Yea man np on the other stuff. Will get to it in the next day or so.

Question regarding this pull. I left the $location.url() in var state = scope.state || $location.url();. Did you really intend to use $location.absUrl()? My guess is most people, by default, would want the full URL (to account for different staging environments). I didn't want to touch this because I was not sure if it was intentional.

[andreareginato]

I should absolutly think more about this. Actually I'm not sure about keeping $location.url() as a default value for state. I would appreciate to start a discussion about the possibility of keeping it (and making it useful) or removing it.

[doapp-ryanp]

My opinion would be to remove the default all together. Most oAuth2 providers (all that I have seen) have it as an optional param. It should be used, but oauth-ng defaulting it may give developers the idea that the CRSF issue has been handled for them, which is a false (and potentially dangerous) assumption.

[andreareginato]

I agree. If you have any time to take it off, would be great.

One question, to eventually move in one different issue. How are you handling the expired token? In a new app I'm creating these days, I move the user to a specific page where I place a Refresh link that will redirect the user to the oauth server. I'm thinking. Would make sense to create a kind of flow to automatically handle the refresh token?

[doapp-ryanp]

Yea I'll remove when I doc and testcase.

Re your other question - its a good one - so I started a new issue here: #17

[doapp-ryanp]

Pull request here #18

I can't figure out how to run your test cases - please checkout my comment in the pull request