💡 添加源码注释

Add unit tests for me.zhyd.oauth.utils.GlobalAuthUtil

README.md

@@ -6,7 +6,7 @@
 </p>
 <p align="center">
 	<a target="_blank" href="https://search.maven.org/search?q=JustAuth">
-		<img src="https://img.shields.io/badge/Maven Central-1.7.0-blue.svg" ></img>
+		<img src="https://img.shields.io/badge/Maven Central-1.8.1-blue.svg" ></img>
 	</a>
 	<a target="_blank" href="https://gitee.com/yadong.zhang/JustAuth/blob/master/LICENSE">
 		<img src="https://img.shields.io/apm/l/vim-mode.svg?color=yellow" ></img>
@@ -14,6 +14,9 @@
 	<a target="_blank" href="https://www.oracle.com/technetwork/java/javase/downloads/index.html">
 		<img src="https://img.shields.io/badge/JDK-1.8+-green.svg" ></img>
 	</a>
+	<a target="_blank" href="https://apidoc.gitee.com/yadong.zhang/JustAuth/">
+		<img src="https://img.shields.io/badge/Docs-1.8.1-orange.svg" ></img>
+	</a>
 </p>
 
 <center>
@@ -65,7 +68,7 @@ JustAuth，如你所见，它仅仅是一个**第三方授权登录**的**工具
 <dependency>
     <groupId>me.zhyd.oauth</groupId>
     <artifactId>JustAuth</artifactId>
-    <version>1.7.0</version>
+    <version>1.8.1</version>
 </dependency>
 ```
 - 调用api
@@ -75,38 +78,42 @@ AuthRequest authRequest = new AuthGiteeRequest(AuthConfig.builder()
         .clientId("clientId")
         .clientSecret("clientSecret")
         .redirectUri("redirectUri")
+        .state("state")
         .build());
 // 生成授权页面
 authRequest.authorize();
-// 授权登录后会返回一个code，用这个code进行登录
-authRequest.login("code");
+// 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的参数
+authRequest.login(callback);
 ```
 
+注：`1.8.0`版本后，增加了`state`参数校验，用于防止[CSRF](https://zh.wikipedia.org/wiki/%E8%B7%A8%E7%AB%99%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0)。强烈建议，保证单次流程内`state`的唯一性，且每个`state`只可用一次。
+
 **配套Demo**：[JustAuth-demo](https://gitee.com/yadong.zhang/JustAuth-demo)
 
 具体的例子可以参考：
 
 - [实现Gitee授权登录](http://t.cn/ExDKxQs)
 - [实现Github授权登录](http://t.cn/EJ0Fxqo)
+- [Spring Boot 快速集成第三方登录功能](http://t.cn/AiWWx5kH)
 
 #### API列表
 |  :computer: 平台  |  :coffee: API类  |  :page_facing_up: SDK  |
 |:------:|:-------:|:-------:|
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/gitee.png" width="20">  |  [AuthGiteeRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  | <a href="https://gitee.com/api/v5/oauth_doc#list_1" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/github.png" width="20">  |  [AuthGithubRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://github.com/settings/developers" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/weibo.png" width="20">  |  [AuthWeiboRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://open.weibo.com/wiki/%E5%BE%AE%E5%8D%9AAPI" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/github.png" width="20">  |  [AuthGithubRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/" target="_blank">参考文档</a> |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/weibo.png" width="20">  |  [AuthWeiboRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java)  |  <a href="https://open.weibo.com/wiki/%E6%8E%88%E6%9D%83%E6%9C%BA%E5%88%B6%E8%AF%B4%E6%98%8E" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/dingtalk.png" width="20">  |  [AuthDingTalkRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDingTalkRequest.java)  |  <a href="https://open-doc.dingtalk.com/microapp/serverapi2/kymkv6" target="_blank">参考文档</a>  |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/baidu.png" width="20">  |  [AuthBaiduRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java)  |  <a href="https://developer.baidu.com/" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/baidu.png" width="20">  |  [AuthBaiduRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java)  |  <a href="http://developer.baidu.com/wiki/index.php?title=docs/oauth" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/coding.png" width="25">  |  [AuthCodingRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java)  |  <a href="https://open.coding.net/references/oauth/" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/tencentCloud.png" width="25">  |  [AuthTencentCloudRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthTencentCloudRequest.java)  |  <a href="https://dev.tencent.com/help/doc/faq/b4e5b7aee786/oauth" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/oschina.png" width="20">  |  [AuthOschinaRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthOschinaRequest.java)  |  <a href="https://www.oschina.net/openapi/docs/openapi_user" target="_blank">参考文档</a> |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/oschina.png" width="20">  |  [AuthOschinaRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthOschinaRequest.java)  |  <a href="https://www.oschina.net/openapi/docs/oauth2_authorize" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/alipay.png" width="20">  |  [AuthAlipayRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java)  |  <a href="https://alipay.open.taobao.com/docs/doc.htm?spm=a219a.7629140.0.0.336d4b70GUKXOl&treeId=193&articleId=105809&docType=1" target="_blank">参考文档</a> |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/qq.png" width="20">  |  [AuthQqRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthQqRequest.java)  |  <a href="http://wiki.connect.qq.com/" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/qq.png" width="20">  |  [AuthQqRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthQqRequest.java)  |  <a href="https://wiki.connect.qq.com/%E4%BD%BF%E7%94%A8authorization_code%E8%8E%B7%E5%8F%96access_token" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/wechat.png" width="20">  |  [AuthWeChatRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthWeChatRequest.java)   |  <a href="https://open.weixin.qq.com/cgi-bin/showdocument?action=dir_list&t=resource/res_list&verify=1&id=open1419316505&token=&lang=zh_CN" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/taobao.png" width="20">  |  [AuthTaobaoRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthTaobaoRequest.java)   |  <a href="https://open.taobao.com/doc.htm?spm=a219a.7386797.0.0.4e00669acnkQy6&source=search&docId=105590&docType=1" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/google.png" width="20">  |  [AuthGoogleRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthGoogleRequest.java)   |  <a href="https://developers.google.com/identity/protocols/OpenIDConnect" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/facebook.png" width="20">  |  [AuthFacebookRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java)   |  <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow" target="_blank">参考文档</a>  |
-|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/douyin.png" width="20">  |  [AuthDouyinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDouyinRequest.java)   |  <a href="https://www.douyin.com/platform/doc" target="_blank">参考文档</a>  |
+|  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/douyin.png" width="20">  |  [AuthDouyinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthDouyinRequest.java)   |  <a href="https://www.douyin.com/platform/doc/m-2-1-1" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/linkedin.png" width="20">  |  [AuthLinkedinRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthLinkedinRequest.java)   |  <a href="https://docs.microsoft.com/zh-cn/linkedin/shared/authentication/authorization-code-flow?context=linkedin/context" target="_blank">参考文档</a>  |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/microsoft.png" width="20">  | [AuthMicrosoftRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java) | <a href="https://docs.microsoft.com/zh-cn/graph/auth/" target="_blank">参考文档</a> |
 |  <img src="https://gitee.com/yadong.zhang/static/raw/master/JustAuth/mi.png" width="20">  | [AuthMiRequest](https://gitee.com/yadong.zhang/JustAuth/blob/master/src/main/java/me/zhyd/oauth/request/AuthMiRequest.java) | <a href="https://dev.mi.com/console/doc/detail?pId=711" target="_blank">参考文档</a> |
@@ -138,6 +145,10 @@ _请知悉：经咨询CSDN官方客服得知，CSDN的授权开放平台已经
 
 [阿里妈妈MUX倾力打造的矢量图标库-iconfont](https://www.iconfont.cn/search/index): 本文档中的图标大部分取自该平台
 
+## 关于OAuth
+
+[The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)
+
 ## 关注&交流
 
 |  公众号  |  微信(备注:加群)  |

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>me.zhyd.oauth</groupId>
     <artifactId>JustAuth</artifactId>
-    <version>1.7.0</version>
+    <version>1.8.1</version>
 
     <name>JustAuth</name>
     <url>https://gitee.com/yadong.zhang/JustAuth</url>
@@ -49,13 +49,12 @@
         <maven-source.version>2.2.1</maven-source.version>
         <maven-compiler.version>3.7.0</maven-compiler.version>
         <maven.test.skip>true</maven.test.skip>
-        <hutool-version>4.1.21</hutool-version>
+        <hutool-version>4.5.15</hutool-version>
         <lombok-version>1.18.4</lombok-version>
         <junit-version>4.11</junit-version>
         <fastjson-version>1.2.44</fastjson-version>
-        <google-api-version>1.28.0</google-api-version>
-        <guava-version>27.1-jre</guava-version>
         <alipay-sdk-version>3.7.4.ALL</alipay-sdk-version>
+        <slf4j-version>1.7.25</slf4j-version>
     </properties>
 
     <dependencies>
@@ -86,6 +85,11 @@
             <version>${alipay-sdk-version}</version>
             <scope>compile</scope>
         </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+            <version>${slf4j-version}</version>
+        </dependency>
     </dependencies>
 
     <build>

src/main/java/me/zhyd/oauth/config/AuthConfig.java

@@ -35,4 +35,20 @@ public class AuthConfig {
      * 支付宝公钥：当选择支付宝登录时，该值可用
      */
     private String alipayPublicKey;
+
+    /**
+     * 是否需要申请unionid，目前只针对qq登录
+     * 注：qq授权登录时，获取unionid需要单独发送邮件申请权限。如果个人开发者账号中申请了该权限，可以将该值置为true，在获取openId时就会同步获取unionId
+     * 参考链接：http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D
+     * <p>
+     * 1.7.1版本新增参数
+     */
+    private boolean unionId;
+
+    /**
+     * 一个神奇的参数，最好使用随机的不可测的内容，可以用来防止CSRF攻击
+     * <p>
+     * 1.8.0版本新增参数
+     */
+    private String state;
 }

src/main/java/me/zhyd/oauth/config/AuthSource.java

@@ -327,7 +327,7 @@ public enum AuthSource {
 
         @Override
         public String refresh() {
-            return "https://open.douyin.com/oauth/refresh_token";
+            return "https://open.douyin.com/oauth/refresh_token/";
         }
     },
     /**

src/main/java/me/zhyd/oauth/enums/AuthBaiduErrorCode.java

@@ -1,4 +1,4 @@
-package me.zhyd.oauth.model;
+package me.zhyd.oauth.enums;
 
 import me.zhyd.oauth.utils.StringUtils;
 

src/main/java/me/zhyd/oauth/enums/AuthDingTalkErrorCode.java

@@ -1,4 +1,4 @@
-package me.zhyd.oauth.model;
+package me.zhyd.oauth.enums;
 
 /**
  * 钉钉授权登录时的异常状态码

src/main/java/me/zhyd/oauth/enums/AuthToutiaoErrorCode.java

@@ -1,4 +1,4 @@
-package me.zhyd.oauth.model;
+package me.zhyd.oauth.enums;
 
 /**
  * 今日头条授权登录时的异常状态码

src/main/java/me/zhyd/oauth/model/AuthCallback.java

@@ -0,0 +1,31 @@
+package me.zhyd.oauth.model;
+
+import lombok.Getter;
+import lombok.Setter;
+
+/**
+ * 授权回调时的参数类
+ *
+ * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
+ * @version 1.0
+ * @since 1.8
+ */
+@Getter
+@Setter
+public class AuthCallback {
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数code
+     */
+    private String code;
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数auth_code，该参数目前只使用于支付宝登录
+     */
+    private String auth_code;
+
+    /**
+     * 访问AuthorizeUrl后回调时带的参数state，用于和请求AuthorizeUrl前的state比较，防止CSRF攻击
+     */
+    private String state;
+}

src/main/java/me/zhyd/oauth/model/AuthResponse.java

@@ -1,7 +1,8 @@
 package me.zhyd.oauth.model;
 
 import lombok.Builder;
-import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;
 import me.zhyd.oauth.request.ResponseStatus;
 
 /**
@@ -11,8 +12,9 @@ import me.zhyd.oauth.request.ResponseStatus;
  * @version 1.0
  * @since 1.8
  */
+@Getter
+@Setter
 @Builder
-@Data
 public class AuthResponse<T> {
     /**
      * 授权响应状态码

src/main/java/me/zhyd/oauth/model/AuthToken.java

@@ -2,6 +2,8 @@ package me.zhyd.oauth.model;
 
 import lombok.Builder;
 import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;
 
 /**
  * 授权所需的token
@@ -10,7 +12,8 @@ import lombok.Data;
  * @version 1.0
  * @since 1.8
  */
-@Data
+@Getter
+@Setter
 @Builder
 public class AuthToken {
     private String accessToken;

src/main/java/me/zhyd/oauth/model/AuthUser.java

@@ -2,6 +2,8 @@ package me.zhyd.oauth.model;
 
 import lombok.Builder;
 import lombok.Data;
+import lombok.Getter;
+import lombok.Setter;
 import me.zhyd.oauth.config.AuthSource;
 
 /**
@@ -11,9 +13,14 @@ import me.zhyd.oauth.config.AuthSource;
  * @version 1.0
  * @since 1.8
  */
+@Getter
+@Setter
 @Builder
-@Data
 public class AuthUser {
+    /**
+     * 用户第三方系统的唯一id。在调用方集成改组件时，可以用uuid + source唯一确定一个用户
+     */
+    private String uuid;
     /**
      * 用户名
      */
@@ -58,8 +65,4 @@ public class AuthUser {
      * 用户授权的token信息
      */
     private AuthToken token;
-    /**
-     * 用户第三方系统的唯一id。在调用方集成改组件时，可以用uuid + source唯一确定一个用户
-     */
-    private String uuid;
 }

src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java

@@ -10,6 +10,7 @@ import com.alipay.api.response.AlipayUserInfoShareResponse;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -34,15 +35,15 @@ public class AuthAlipayRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
         AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
         request.setGrantType("authorization_code");
-        request.setCode(code);
+        request.setCode(authCallback.getAuth_code());
         AlipaySystemOauthTokenResponse response = null;
         try {
             response = this.alipayClient.execute(request);
         } catch (Exception e) {
-            throw new AuthException("Unable to get token from alipay using code [" + code + "]", e);
+            throw new AuthException("Unable to get token from alipay using code [" + authCallback.getAuth_code() + "]", e);
         }
         if (!response.isSuccess()) {
             throw new AuthException(response.getSubMsg());
@@ -92,6 +93,6 @@ public class AuthAlipayRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getAlipayAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getAlipayAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthBaiduRequest.java

@@ -5,6 +5,7 @@ import cn.hutool.http.HttpResponse;
 import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
+import me.zhyd.oauth.enums.AuthBaiduErrorCode;
 import me.zhyd.oauth.exception.AuthException;
 import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
@@ -23,16 +24,21 @@ public class AuthBaiduRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getBaiduAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getBaiduAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                 .getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         JSONObject accessTokenObject = JSONObject.parseObject(response.body());
         AuthBaiduErrorCode errorCode = AuthBaiduErrorCode.getErrorCode(accessTokenObject.getString("error"));
-        if (!AuthBaiduErrorCode.OK.equals(errorCode)) {
+        if (AuthBaiduErrorCode.OK != errorCode) {
             throw new AuthException(errorCode.getDesc());
         }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .scope(accessTokenObject.getString("scope"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .build();
     }
 
     @Override
@@ -42,7 +48,7 @@ public class AuthBaiduRequest extends BaseAuthRequest {
         String userInfo = response.body();
         JSONObject object = JSONObject.parseObject(userInfo);
         AuthBaiduErrorCode errorCode = AuthBaiduErrorCode.getErrorCode(object.getString("error"));
-        if (!AuthBaiduErrorCode.OK.equals(errorCode)) {
+        if (AuthBaiduErrorCode.OK != errorCode) {
             throw new AuthException(errorCode.getDesc());
         }
         return AuthUser.builder()
@@ -62,7 +68,7 @@ public class AuthBaiduRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getBaiduAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getBaiduAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     @Override

src/main/java/me/zhyd/oauth/request/AuthCodingRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,14 +26,18 @@ public class AuthCodingRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getCodingAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getCodingAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
         JSONObject accessTokenObject = JSONObject.parseObject(response.body());
         if (accessTokenObject.getIntValue("code") != 0) {
-            throw new AuthException("Unable to get token from coding using code [" + code + "]");
+            throw new AuthException("Unable to get token from coding using code [" + authCallback.getCode() + "]");
         }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .build();
     }
 
     @Override
@@ -68,6 +73,6 @@ public class AuthCodingRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getCodingAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getCodingAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthCsdnRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,13 +26,13 @@ public class AuthCsdnRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getCsdnAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getCsdnAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                 .getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         JSONObject accessTokenObject = JSONObject.parseObject(response.body());
         if (accessTokenObject.containsKey("error_code")) {
-            throw new AuthException("Unable to get token from csdn using code [" + code + "]");
+            throw new AuthException("Unable to get token from csdn using code [" + authCallback.getCode() + "]");
         }
         return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
     }
@@ -62,6 +63,6 @@ public class AuthCsdnRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getCsdnAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getCsdnAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthDingTalkRequest.java

@@ -6,11 +6,9 @@ import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
+import me.zhyd.oauth.enums.AuthDingTalkErrorCode;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthDingTalkErrorCode;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.GlobalAuthUtil;
 import me.zhyd.oauth.utils.UrlBuilder;
 
@@ -28,8 +26,8 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        return AuthToken.builder().accessCode(code).build();
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        return AuthToken.builder().accessCode(authCallback.getCode()).build();
     }
 
     @Override
@@ -40,13 +38,12 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
         String urlEncodeSignature = GlobalAuthUtil.generateDingTalkSignature(config.getClientSecret(), timestamp);
         JSONObject param = new JSONObject();
         param.put("tmp_auth_code", code);
-        HttpResponse response = HttpRequest.post(UrlBuilder.getDingTalkUserInfoUrl(urlEncodeSignature, timestamp, config.getClientId()))
-                .body(param.toJSONString())
-                .execute();
+        HttpResponse response = HttpRequest.post(UrlBuilder.getDingTalkUserInfoUrl(urlEncodeSignature, timestamp, config
+                .getClientId())).body(param.toJSONString()).execute();
         String userInfo = response.body();
         JSONObject object = JSON.parseObject(userInfo);
         AuthDingTalkErrorCode errorCode = AuthDingTalkErrorCode.getErrorCode(object.getIntValue("errcode"));
-        if (!AuthDingTalkErrorCode.EC0.equals(errorCode)) {
+        if (AuthDingTalkErrorCode.EC0 != errorCode) {
             throw new AuthException(errorCode.getDesc());
         }
         object = object.getJSONObject("user_info");
@@ -71,6 +68,6 @@ public class AuthDingTalkRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getDingTalkQrConnectUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getDingTalkQrConnectUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthDouyinRequest.java

@@ -6,10 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
 
 
@@ -27,8 +24,8 @@ public class AuthDouyinRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getDouyinAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getDouyinAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
         return this.getToken(accessTokenUrl);
     }
 
@@ -61,7 +58,7 @@ public class AuthDouyinRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getDouyinAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getDouyinAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     @Override

src/main/java/me/zhyd/oauth/request/AuthFacebookRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,20 +26,20 @@ public class AuthFacebookRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getFacebookAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getFacebookAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
 
-        if (object.containsKey("error")) {
-            throw new AuthException(object.getJSONObject("error").getString("message"));
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(accessTokenObject.getJSONObject("error").getString("message"));
         }
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .tokenType(object.getString("token_type"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .tokenType(accessTokenObject.getString("token_type"))
                 .build();
     }
 
@@ -79,6 +80,6 @@ public class AuthFacebookRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getFacebookAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getFacebookAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthGiteeRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,13 +26,13 @@ public class AuthGiteeRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGiteeAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGiteeAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         JSONObject accessTokenObject = JSONObject.parseObject(response.body());
         if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from gitee using code [" + code + "]");
+            throw new AuthException("Unable to get token from gitee using code [" + authCallback.getCode() + "]");
         }
         return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
     }
@@ -65,6 +66,6 @@ public class AuthGiteeRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getGiteeAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGiteeAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthGithubRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -28,9 +29,8 @@ public class AuthGithubRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGithubAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGithubAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config.getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         Map<String, String> res = GlobalAuthUtil.parseStringToMap(response.body());
         if (res.containsKey("error")) {
@@ -68,6 +68,6 @@ public class AuthGithubRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getGithubAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGithubAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthGoogleRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,23 +26,23 @@ public class AuthGoogleRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getGoogleAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getGoogleAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                 .getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
 
-        if (object.containsKey("error") || object.containsKey("error_description")) {
-            throw new AuthException("get google access_token has error:[" + object.getString("error") + "], error_description:[" + object
+        if (accessTokenObject.containsKey("error") || accessTokenObject.containsKey("error_description")) {
+            throw new AuthException("get google access_token has error:[" + accessTokenObject.getString("error") + "], error_description:[" + accessTokenObject
                     .getString("error_description") + "]");
         }
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .idToken(object.getString("id_token"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .idToken(accessTokenObject.getString("id_token"))
                 .build();
     }
 
@@ -71,6 +72,6 @@ public class AuthGoogleRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getGoogleAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getGoogleAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthLinkedinRequest.java

@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.StringUtils;
 import me.zhyd.oauth.utils.UrlBuilder;
 
@@ -29,8 +26,8 @@ public class AuthLinkedinRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getLinkedinAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getLinkedinAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                 .getRedirectUri());
         return this.getToken(accessTokenUrl);
     }
@@ -96,7 +93,7 @@ public class AuthLinkedinRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getLinkedinAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getLinkedinAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     private String getUserEmail(String accessToken) {

src/main/java/me/zhyd/oauth/request/AuthMiRequest.java

@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
 
 import java.text.MessageFormat;
@@ -30,29 +27,29 @@ public class AuthMiRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getMiAccessTokenUrl(config.getClientId(), config.getClientSecret(), config.getRedirectUri(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getMiAccessTokenUrl(config.getClientId(), config.getClientSecret(), config.getRedirectUri(), authCallback.getCode());
         return getToken(accessTokenUrl);
     }
 
     private AuthToken getToken(String accessTokenUrl) {
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
         String jsonStr = StrUtil.replace(response.body(), PREFIX, StrUtil.EMPTY);
-        JSONObject object = JSONObject.parseObject(jsonStr);
+        JSONObject accessTokenObject = JSONObject.parseObject(jsonStr);
 
-        if (object.containsKey("error")) {
-            throw new AuthException(object.getString("error_description"));
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(accessTokenObject.getString("error_description"));
         }
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .refreshToken(object.getString("refresh_token"))
-                .openId(object.getString("openId"))
-                .macAlgorithm(object.getString("mac_algorithm"))
-                .macKey(object.getString("mac_key"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .openId(accessTokenObject.getString("openId"))
+                .macAlgorithm(accessTokenObject.getString("mac_algorithm"))
+                .macKey(accessTokenObject.getString("mac_key"))
                 .build();
     }
 
@@ -63,7 +60,7 @@ public class AuthMiRequest extends BaseAuthRequest {
                 .execute();
 
         JSONObject userProfile = JSONObject.parseObject(userResponse.body());
-        if (StrUtil.equalsIgnoreCase(userProfile.getString("result"), "error")) {
+        if ("error".equalsIgnoreCase(userProfile.getString("result"))) {
             throw new AuthException(userProfile.getString("description"));
         }
 
@@ -86,7 +83,7 @@ public class AuthMiRequest extends BaseAuthRequest {
 
         HttpResponse emailResponse = HttpRequest.get(emailPhoneUrl).execute();
         JSONObject userEmailPhone = JSONObject.parseObject(emailResponse.body());
-        if (!StrUtil.equalsIgnoreCase(userEmailPhone.getString("result"), "error")) {
+        if (!"error".equalsIgnoreCase(userEmailPhone.getString("result"))) {
             JSONObject emailPhone = userEmailPhone.getJSONObject("data");
             authUser.setEmail(emailPhone.getString("email"));
         }
@@ -101,7 +98,7 @@ public class AuthMiRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getMiAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getMiAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     /**

src/main/java/me/zhyd/oauth/request/AuthMicrosoftRequest.java

@@ -7,10 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
 
 import java.util.HashMap;
@@ -29,9 +26,9 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
         String accessTokenUrl = UrlBuilder.getMicrosoftAccessTokenUrl(config.getClientId(), config.getClientSecret(), config
-                .getRedirectUri(), code);
+                .getRedirectUri(), authCallback.getCode());
 
         return getToken(accessTokenUrl);
     }
@@ -51,16 +48,16 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
                 .form(paramMap)
                 .execute();
         String accessTokenStr = response.body();
-        JSONObject object = JSONObject.parseObject(accessTokenStr);
+        JSONObject accessTokenObject = JSONObject.parseObject(accessTokenStr);
 
-        this.checkResponse(object);
+        this.checkResponse(accessTokenObject);
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .scope(object.getString("scope"))
-                .tokenType(object.getString("token_type"))
-                .refreshToken(object.getString("refresh_token"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .scope(accessTokenObject.getString("scope"))
+                .tokenType(accessTokenObject.getString("token_type"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
                 .build();
     }
 
@@ -99,7 +96,7 @@ public class AuthMicrosoftRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getMicrosoftAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getMicrosoftAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     /**

src/main/java/me/zhyd/oauth/request/AuthOschinaRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,15 +26,20 @@ public class AuthOschinaRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getOschinaAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getOschinaAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         JSONObject accessTokenObject = JSONObject.parseObject(response.body());
         if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from oschina using code [" + code + "]");
+            throw new AuthException("Unable to get token from oschina using code [" + authCallback.getCode() + "]");
         }
-        return AuthToken.builder().accessToken(accessTokenObject.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .uid(accessTokenObject.getString("uid"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .build();
     }
 
     @Override
@@ -65,6 +71,6 @@ public class AuthOschinaRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getOschinaAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getOschinaAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthQqRequest.java

@@ -7,6 +7,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -30,13 +31,13 @@ public class AuthQqRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getQqAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
-                .getRedirectUri());
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getQqAccessTokenUrl(config.getClientId(), config.getClientSecret(),
+                authCallback.getCode(), config.getRedirectUri());
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
         Map<String, String> accessTokenObject = GlobalAuthUtil.parseStringToMap(response.body());
         if (!accessTokenObject.containsKey("access_token")) {
-            throw new AuthException("Unable to get token from qq using code [" + code + "]");
+            throw new AuthException("Unable to get token from qq using code [" + authCallback.getCode() + "]");
         }
         return AuthToken.builder()
                 .accessToken(accessTokenObject.get("access_token"))
@@ -80,12 +81,12 @@ public class AuthQqRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getQqAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getQqAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     private String getOpenId(AuthToken authToken) {
         String accessToken = authToken.getAccessToken();
-        HttpResponse response = HttpRequest.get(UrlBuilder.getQqOpenidUrl("https://graph.qq.com/oauth2.0/me", accessToken))
+        HttpResponse response = HttpRequest.get(UrlBuilder.getQqOpenidUrl("https://graph.qq.com/oauth2.0/me", accessToken, config.isUnionId()))
                 .execute();
         if (response.isOk()) {
             String body = response.body();
@@ -97,7 +98,9 @@ public class AuthQqRequest extends BaseAuthRequest {
                 throw new AuthException(object.get("error") + ":" + object.get("error_description"));
             }
             authToken.setOpenId(object.getString("openid"));
-            authToken.setUnionId(object.getString("unionid"));
+            if (object.containsKey("unionid")) {
+                authToken.setUnionId(object.getString("unionid"));
+            }
             return StringUtils.isEmpty(authToken.getUnionId()) ? authToken.getOpenId() : authToken.getUnionId();
         }
 

src/main/java/me/zhyd/oauth/request/AuthRequest.java

@@ -1,6 +1,7 @@
 package me.zhyd.oauth.request;
 
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.model.AuthToken;
 
@@ -23,10 +24,10 @@ public interface AuthRequest {
     /**
      * 第三方登录
      *
-     * @param code 通过authorize换回的code
+     * @param authCallback 用于接收回调参数的实体
      * @return 返回登录成功后的用户信息
      */
-    default AuthResponse login(String code) {
+    default AuthResponse login(AuthCallback authCallback) {
         throw new AuthException(ResponseStatus.NOT_IMPLEMENTED);
     }
 

src/main/java/me/zhyd/oauth/request/AuthTaobaoRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -26,8 +27,8 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        return AuthToken.builder().accessCode(code).build();
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        return AuthToken.builder().accessCode(authCallback.getCode()).build();
     }
 
     @Override
@@ -35,19 +36,19 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
         String accessCode = authToken.getAccessCode();
         HttpResponse response = HttpRequest.post(UrlBuilder.getTaobaoAccessTokenUrl(this.config.getClientId(), this.config
                 .getClientSecret(), accessCode, this.config.getRedirectUri())).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
-        if (object.containsKey("error")) {
-            throw new AuthException(ResponseStatus.FAILURE + ":" + object.getString("error_description"));
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
+        if (accessTokenObject.containsKey("error")) {
+            throw new AuthException(ResponseStatus.FAILURE + ":" + accessTokenObject.getString("error_description"));
         }
-        authToken.setAccessToken(object.getString("access_token"));
-        authToken.setRefreshToken(object.getString("refresh_token"));
-        authToken.setExpireIn(object.getIntValue("expires_in"));
-        authToken.setUid(object.getString("taobao_user_id"));
-        authToken.setOpenId(object.getString("taobao_open_uid"));
+        authToken.setAccessToken(accessTokenObject.getString("access_token"));
+        authToken.setRefreshToken(accessTokenObject.getString("refresh_token"));
+        authToken.setExpireIn(accessTokenObject.getIntValue("expires_in"));
+        authToken.setUid(accessTokenObject.getString("taobao_user_id"));
+        authToken.setOpenId(accessTokenObject.getString("taobao_open_uid"));
 
-        String nick = GlobalAuthUtil.urlDecode(object.getString("taobao_user_nick"));
+        String nick = GlobalAuthUtil.urlDecode(accessTokenObject.getString("taobao_user_nick"));
         return AuthUser.builder()
-                .uuid(object.getString("taobao_user_id"))
+                .uuid(accessTokenObject.getString("taobao_user_id"))
                 .username(nick)
                 .nickname(nick)
                 .gender(AuthUserGender.UNKNOW)
@@ -63,6 +64,6 @@ public class AuthTaobaoRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getTaobaoAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getTaobaoAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthTencentCloudRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -25,14 +26,18 @@ public class AuthTencentCloudRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getTencentCloudAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getTencentCloudAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
-        if (object.getIntValue("code") != 0) {
-            throw new AuthException("Unable to get token from tencent cloud using code [" + code + "]: " + object.get("msg"));
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
+        if (accessTokenObject.getIntValue("code") != 0) {
+            throw new AuthException("Unable to get token from tencent cloud using code [" + authCallback.getCode() + "]: " + accessTokenObject.get("msg"));
         }
-        return AuthToken.builder().accessToken(object.getString("access_token")).build();
+        return AuthToken.builder()
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .build();
     }
 
     @Override
@@ -67,6 +72,6 @@ public class AuthTencentCloudRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getTencentCloudAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getTencentCloudAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthToutiaoRequest.java

@@ -5,11 +5,9 @@ import cn.hutool.http.HttpResponse;
 import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
+import me.zhyd.oauth.enums.AuthToutiaoErrorCode;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthToutiaoErrorCode;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
 
 /**
@@ -26,19 +24,19 @@ public class AuthToutiaoRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getToutiaoAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getToutiaoAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
 
-        if (object.containsKey("error_code")) {
-            throw new AuthException(AuthToutiaoErrorCode.getErrorCode(object.getIntValue("error_code")).getDesc());
+        if (accessTokenObject.containsKey("error_code")) {
+            throw new AuthException(AuthToutiaoErrorCode.getErrorCode(accessTokenObject.getIntValue("error_code")).getDesc());
         }
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .openId(object.getString("open_id"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .openId(accessTokenObject.getString("open_id"))
                 .build();
     }
 
@@ -76,6 +74,6 @@ public class AuthToutiaoRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getToutiaoAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getToutiaoAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/AuthWeChatRequest.java

@@ -6,10 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
-import me.zhyd.oauth.model.AuthResponse;
-import me.zhyd.oauth.model.AuthToken;
-import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.model.AuthUserGender;
+import me.zhyd.oauth.model.*;
 import me.zhyd.oauth.utils.UrlBuilder;
 
 /**
@@ -27,12 +24,12 @@ public class AuthWeChatRequest extends BaseAuthRequest {
     /**
      * 微信的特殊性，此时返回的信息同时包含 openid 和 access_token
      *
-     * @param code 授权码
+     * @param authCallback 回调返回的参数
      * @return 所有信息
      */
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getWeChatAccessTokenUrl(config.getClientId(), config.getClientSecret(), code);
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getWeChatAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode());
         return this.getToken(accessTokenUrl);
     }
 
@@ -66,7 +63,7 @@ public class AuthWeChatRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getWeChatAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getWeChatAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 
     @Override
@@ -97,15 +94,15 @@ public class AuthWeChatRequest extends BaseAuthRequest {
      */
     private AuthToken getToken(String accessTokenUrl) {
         HttpResponse response = HttpRequest.get(accessTokenUrl).execute();
-        JSONObject object = JSONObject.parseObject(response.body());
+        JSONObject accessTokenObject = JSONObject.parseObject(response.body());
 
-        this.checkResponse(object);
+        this.checkResponse(accessTokenObject);
 
         return AuthToken.builder()
-                .accessToken(object.getString("access_token"))
-                .refreshToken(object.getString("refresh_token"))
-                .expireIn(object.getIntValue("expires_in"))
-                .openId(object.getString("openid"))
+                .accessToken(accessTokenObject.getString("access_token"))
+                .refreshToken(accessTokenObject.getString("refresh_token"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
+                .openId(accessTokenObject.getString("openid"))
                 .build();
     }
 }

src/main/java/me/zhyd/oauth/request/AuthWeiboRequest.java

@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
 import me.zhyd.oauth.model.AuthUserGender;
@@ -28,19 +29,20 @@ public class AuthWeiboRequest extends BaseAuthRequest {
     }
 
     @Override
-    protected AuthToken getAccessToken(String code) {
-        String accessTokenUrl = UrlBuilder.getWeiboAccessTokenUrl(config.getClientId(), config.getClientSecret(), code, config
+    protected AuthToken getAccessToken(AuthCallback authCallback) {
+        String accessTokenUrl = UrlBuilder.getWeiboAccessTokenUrl(config.getClientId(), config.getClientSecret(), authCallback.getCode(), config
                 .getRedirectUri());
         HttpResponse response = HttpRequest.post(accessTokenUrl).execute();
         String accessTokenStr = response.body();
         JSONObject accessTokenObject = JSONObject.parseObject(accessTokenStr);
         if (accessTokenObject.containsKey("error")) {
-            throw new AuthException("Unable to get token from weibo using code [" + code + "]:" + accessTokenObject.getString("error_description"));
+            throw new AuthException("Unable to get token from weibo using code [" + authCallback.getCode() + "]:" + accessTokenObject.getString("error_description"));
         }
         return AuthToken.builder()
                 .accessToken(accessTokenObject.getString("access_token"))
                 .uid(accessTokenObject.getString("uid"))
-                .expireIn(accessTokenObject.getIntValue("remind_in"))
+                .openId(accessTokenObject.getString("uid"))
+                .expireIn(accessTokenObject.getIntValue("expires_in"))
                 .build();
     }
 
@@ -80,6 +82,6 @@ public class AuthWeiboRequest extends BaseAuthRequest {
      */
     @Override
     public String authorize() {
-        return UrlBuilder.getWeiboAuthorizeUrl(config.getClientId(), config.getRedirectUri());
+        return UrlBuilder.getWeiboAuthorizeUrl(config.getClientId(), config.getRedirectUri(), config.getState());
     }
 }

src/main/java/me/zhyd/oauth/request/BaseAuthRequest.java

@@ -4,10 +4,11 @@ import lombok.Data;
 import me.zhyd.oauth.config.AuthConfig;
 import me.zhyd.oauth.config.AuthSource;
 import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.model.AuthToken;
 import me.zhyd.oauth.model.AuthUser;
-import me.zhyd.oauth.utils.AuthConfigChecker;
+import me.zhyd.oauth.utils.AuthChecker;
 
 /**
  * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
@@ -22,21 +23,24 @@ public abstract class BaseAuthRequest implements AuthRequest {
     public BaseAuthRequest(AuthConfig config, AuthSource source) {
         this.config = config;
         this.source = source;
-        if (!AuthConfigChecker.isSupportedAuth(config, source)) {
+        if (!AuthChecker.isSupportedAuth(config, source)) {
             throw new AuthException(ResponseStatus.PARAMETER_INCOMPLETE);
         }
         // 校验配置合法性
-        AuthConfigChecker.check(config, source);
+        AuthChecker.checkConfig(config, source);
     }
 
-    protected abstract AuthToken getAccessToken(String code);
+    protected abstract AuthToken getAccessToken(AuthCallback authCallback);
 
     protected abstract AuthUser getUserInfo(AuthToken authToken);
 
     @Override
-    public AuthResponse login(String code) {
+    public AuthResponse login(AuthCallback authCallback) {
         try {
-            AuthToken authToken = this.getAccessToken(code);
+            AuthChecker.checkCode(source == AuthSource.ALIPAY ? authCallback.getAuth_code() : authCallback.getCode());
+            AuthChecker.checkState(authCallback.getState(), config.getState());
+
+            AuthToken authToken = this.getAccessToken(authCallback);
             AuthUser user = this.getUserInfo(authToken);
             return AuthResponse.builder().code(ResponseStatus.SUCCESS.getCode()).data(user).build();
         } catch (Exception e) {

src/main/java/me/zhyd/oauth/request/ResponseStatus.java

@@ -14,6 +14,8 @@ public enum ResponseStatus {
     NO_AUTH_SOURCE(5004, "AuthSource cannot be null"),
     UNIDENTIFIED_PLATFORM(5005, "Unidentified platform"),
     ILLEGAL_REDIRECT_URI(5006, "Illegal redirect uri"),
+    ILLEGAL_REQUEST(5007, "Illegal request"),
+    ILLEGAL_CODE(5008, "Illegal code"),
     ;
 
     private int code;

src/main/java/me/zhyd/oauth/utils/AuthChecker.java

@@ -12,7 +12,7 @@ import me.zhyd.oauth.request.ResponseStatus;
  * @version 1.0
  * @since 1.8
  */
-public class AuthConfigChecker {
+public class AuthChecker {
 
     /**
      * 是否支持第三方登录
@@ -35,7 +35,7 @@ public class AuthConfigChecker {
      * @param config config
      * @param source source
      */
-    public static void check(AuthConfig config, AuthSource source) {
+    public static void checkConfig(AuthConfig config, AuthSource source) {
         String redirectUri = config.getRedirectUri();
         if (!GlobalAuthUtil.isHttpProtocol(redirectUri) && !GlobalAuthUtil.isHttpsProtocol(redirectUri)) {
             throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
@@ -49,4 +49,36 @@ public class AuthConfigChecker {
             throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
         }
     }
+
+    /**
+     * 校验回调传回的code
+     *
+     * @param code 回调时传回的code
+     */
+    public static void checkCode(String code) {
+        if (StringUtils.isEmpty(code)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_CODE);
+        }
+    }
+
+    /**
+     * 校验state的合法性防止被CSRF
+     *
+     * @param newState      新的state，一般为回调时传回的state（可能被篡改）
+     * @param originalState 原始的state，发起授权时向第三方平台传递的state
+     */
+    public static void checkState(String newState, String originalState) {
+        // 如果原始state为空，表示当前平台未使用state
+        if (StringUtils.isEmpty(originalState)) {
+            return;
+        }
+        // 如果授权之前使用了state，但是回调时未返回state，则表示当前请求为非法的请求，可能正在被CSRF攻击
+        if (StringUtils.isEmpty(newState)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
+        }
+        // 如果授权前后的state不一致，则表示当前请求为非法的请求，新的state可能为伪造
+        if (!newState.equals(originalState)) {
+            throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
+        }
+    }
 }

src/main/java/me/zhyd/oauth/utils/AuthState.java

@@ -0,0 +1,165 @@
+package me.zhyd.oauth.utils;
+
+import cn.hutool.core.codec.Base64;
+import cn.hutool.core.util.RandomUtil;
+import com.alibaba.fastjson.JSON;
+import lombok.extern.slf4j.Slf4j;
+import me.zhyd.oauth.exception.AuthException;
+import me.zhyd.oauth.request.ResponseStatus;
+
+import java.nio.charset.Charset;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * state工具，负责创建、获取和删除state
+ *
+ * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
+ * @version 1.0
+ * @since 1.8
+ */
+@Slf4j
+public class AuthState {
+
+    /**
+     * 空字符串
+     */
+    private static final String EMPTY_STR = "";
+
+    /**
+     * state存储器
+     */
+    private static ConcurrentHashMap<String, String> stateBucket = new ConcurrentHashMap<>();
+
+    /**
+     * 生成随机的state
+     *
+     * @param source oauth平台
+     * @return state
+     */
+    public static String create(String source) {
+        return create(source, RandomUtil.randomString(4));
+    }
+
+    /**
+     * 创建state
+     *
+     * @param source oauth平台
+     * @param body   希望加密到state的消息体
+     * @return state
+     */
+    public static String create(String source, Object body) {
+        return create(source, JSON.toJSONString(body));
+    }
+
+    /**
+     * 创建state
+     *
+     * @param source oauth平台
+     * @param body   希望加密到state的消息体
+     * @return state
+     */
+    public static String create(String source, String body) {
+        String currentIp = getCurrentIp();
+        String simpleKey = ((source + currentIp));
+        String key = Base64.encode(simpleKey.getBytes(Charset.forName("UTF-8")));
+        log.debug("Create the state: ip={}, platform={}, simpleKey={}, key={}, body={}", currentIp, source, simpleKey, key, body);
+
+        if (stateBucket.containsKey(key)) {
+            log.debug("Get from bucket: {}", stateBucket.get(key));
+            return stateBucket.get(key);
+        }
+
+        String simpleState = source + "_" + currentIp + "_" + body;
+        String state = Base64.encode(simpleState.getBytes(Charset.forName("UTF-8")));
+        log.debug("Create a new state: {}", state, simpleState);
+        stateBucket.put(key, state);
+        return state;
+    }
+
+    /**
+     * 获取state
+     *
+     * @param source oauth平台
+     * @return state
+     */
+    public static String get(String source) {
+        String currentIp = getCurrentIp();
+        String simpleKey = ((source + currentIp));
+        String key = Base64.encode(simpleKey.getBytes(Charset.forName("UTF-8")));
+        log.debug("Get state by the key[{}], current ip[{}]", key, currentIp);
+        return stateBucket.get(key);
+    }
+
+    /**
+     * 获取state中保存的body内容
+     *
+     * @param source oauth平台
+     * @param state  加密后的state
+     * @param clazz  body的实际类型
+     * @param <T>    需要转换的具体的class类型
+     * @return state
+     */
+    public static <T> T getBody(String source, String state, Class<T> clazz) {
+        if (StringUtils.isEmpty(state) || null == clazz) {
+            return null;
+        }
+        log.debug("Get body from the state[{}] of the {} and convert it to {}", state, source, clazz.toString());
+        String currentIp = getCurrentIp();
+        String decodedState = Base64.decodeStr(state);
+        log.debug("The decoded state is [{}]", decodedState);
+        if (!decodedState.startsWith(source)) {
+            return null;
+        }
+        String noneSourceState = decodedState.substring(source.length() + 1);
+        if (!noneSourceState.startsWith(currentIp)) {
+            // ip不相同，可能为非法的请求
+            throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
+        }
+        String body = noneSourceState.substring(currentIp.length() + 1);
+        log.debug("body is [{}]", body);
+        if (clazz == String.class) {
+            return (T) body;
+        }
+        if (clazz == Integer.class) {
+            return (T) Integer.valueOf(Integer.parseInt(body));
+        }
+        if (clazz == Long.class) {
+            return (T) Long.valueOf(Long.parseLong(body));
+        }
+        if (clazz == Short.class) {
+            return (T) Short.valueOf(Short.parseShort(body));
+        }
+        if (clazz == Double.class) {
+            return (T) Double.valueOf(Double.parseDouble(body));
+        }
+        if (clazz == Float.class) {
+            return (T) Float.valueOf(Float.parseFloat(body));
+        }
+        if (clazz == Boolean.class) {
+            return (T) Boolean.valueOf(Boolean.parseBoolean(body));
+        }
+        if (clazz == Byte.class) {
+            return (T) Byte.valueOf(Byte.parseByte(body));
+        }
+        return JSON.parseObject(body, clazz);
+    }
+
+    /**
+     * 登录成功后，清除state
+     *
+     * @param source oauth平台
+     */
+    public static void delete(String source) {
+        String currentIp = getCurrentIp();
+
+        String simpleKey = ((source + currentIp));
+        String key = Base64.encode(simpleKey.getBytes(Charset.forName("UTF-8")));
+        log.debug("Delete used state[{}] by the key[{}], current ip[{}]", stateBucket.get(key), key, currentIp);
+        stateBucket.remove(key);
+    }
+
+    private static String getCurrentIp() {
+        String currentIp = IpUtils.getIp();
+        return StringUtils.isEmpty(currentIp) ? EMPTY_STR : currentIp;
+    }
+}

src/main/java/me/zhyd/oauth/utils/GlobalAuthUtil.java

@@ -8,6 +8,8 @@ import javax.crypto.spec.SecretKeySpec;
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
@@ -22,16 +24,12 @@ import java.util.Map;
  * @since 1.8
  */
 public class GlobalAuthUtil {
-    private static final String DEFAULT_ENCODING = "UTF-8";
+    private static final Charset DEFAULT_ENCODING = StandardCharsets.UTF_8;
     private static final String ALGORITHM = "HmacSHA256";
 
     public static String generateDingTalkSignature(String secretKey, String timestamp) {
-        try {
-            byte[] signData = sign(secretKey.getBytes(DEFAULT_ENCODING), timestamp.getBytes(DEFAULT_ENCODING));
-            return urlEncode(new String(Base64.encode(signData, false)));
-        } catch (UnsupportedEncodingException ex) {
-            throw new AuthException("Unsupported algorithm: " + DEFAULT_ENCODING, ex);
-        }
+        byte[] signData = sign(secretKey.getBytes(DEFAULT_ENCODING), timestamp.getBytes(DEFAULT_ENCODING));
+        return urlEncode(new String(Base64.encode(signData, false)));
     }
 
     private static byte[] sign(byte[] key, byte[] data) {
@@ -52,9 +50,8 @@ public class GlobalAuthUtil {
         }
 
         try {
-            String encoded = URLEncoder.encode(value, GlobalAuthUtil.DEFAULT_ENCODING);
-            return encoded.replace("+", "%20").replace("*", "%2A")
-                    .replace("~", "%7E").replace("/", "%2F");
+            String encoded = URLEncoder.encode(value, GlobalAuthUtil.DEFAULT_ENCODING.displayName());
+            return encoded.replace("+", "%20").replace("*", "%2A").replace("~", "%7E").replace("/", "%2F");
         } catch (UnsupportedEncodingException e) {
             throw new AuthException("Failed To Encode Uri", e);
         }
@@ -65,7 +62,7 @@ public class GlobalAuthUtil {
             return "";
         }
         try {
-            return URLDecoder.decode(value, GlobalAuthUtil.DEFAULT_ENCODING);
+            return URLDecoder.decode(value, GlobalAuthUtil.DEFAULT_ENCODING.displayName());
         } catch (UnsupportedEncodingException e) {
             throw new AuthException("Failed To Decode Uri", e);
         }

src/main/java/me/zhyd/oauth/utils/UrlBuilder.java

@@ -15,7 +15,7 @@ public class UrlBuilder {
 
     private static final String GITHUB_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&code={3}&redirect_uri={4}";
     private static final String GITHUB_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String GITHUB_AUTHORIZE_PATTERN = "{0}?client_id={1}&state=1&redirect_uri={2}";
+    private static final String GITHUB_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&state={3}";
 
     private static final String GOOGLE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&scope=openid%20email%20profile&redirect_uri={2}&state={3}";
     private static final String GOOGLE_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&code={3}&redirect_uri={4}&grant_type=authorization_code";
@@ -23,42 +23,42 @@ public class UrlBuilder {
 
     private static final String WEIBO_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
     private static final String WEIBO_USER_INFO_PATTERN = "{0}?{1}";
-    private static final String WEIBO_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String WEIBO_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
 
     private static final String GITEE_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
     private static final String GITEE_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String GITEE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String GITEE_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
 
-    private static final String DING_TALK_QRCONNECT_PATTERN = "{0}?appid={1}&response_type=code&scope=snsapi_login&state=STATE&redirect_uri={2}";
+    private static final String DING_TALK_QRCONNECT_PATTERN = "{0}?appid={1}&response_type=code&scope=snsapi_login&redirect_uri={2}&state={3}";
     private static final String DING_TALK_USER_INFO_PATTERN = "{0}?signature={1}&timestamp={2}&accessKey={3}";
 
     private static final String BAIDU_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
     private static final String BAIDU_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String BAIDU_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&display=popup";
+    private static final String BAIDU_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&display=popup&state={3}";
     private static final String BAIDU_REVOKE_PATTERN = "{0}?access_token={1}";
 
     private static final String CSDN_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
     private static final String CSDN_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String CSDN_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String CSDN_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
 
     private static final String CODING_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}";
     private static final String CODING_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String CODING_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user";
+    private static final String CODING_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user&state={3}";
 
     private static final String TENCENT_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}";
     private static final String TENCENT_USER_INFO_PATTERN = "{0}?access_token={1}";
-    private static final String TENCENT_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user";
+    private static final String TENCENT_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&scope=user&state={3}";
 
     private static final String OSCHINA_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}&dataType=json";
     private static final String OSCHINA_USER_INFO_PATTERN = "{0}?access_token={1}&dataType=json";
-    private static final String OSCHINA_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}";
+    private static final String OSCHINA_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
 
-    private static final String ALIPAY_AUTHORIZE_PATTERN = "{0}?app_id={1}&scope=auth_user&redirect_uri={2}&state=init";
+    private static final String ALIPAY_AUTHORIZE_PATTERN = "{0}?app_id={1}&scope=auth_user&redirect_uri={2}&state={3}";
 
     private static final String QQ_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&grant_type=authorization_code&code={3}&redirect_uri={4}";
     private static final String QQ_USER_INFO_PATTERN = "{0}?oauth_consumer_key={1}&access_token={2}&openid={3}";
     private static final String QQ_AUTHORIZE_PATTERN = "{0}?client_id={1}&response_type=code&redirect_uri={2}&state={3}";
-    private static final String QQ_OPENID_PATTERN = "{0}?access_token={1}&unionid=1";
+    private static final String QQ_OPENID_PATTERN = "{0}?access_token={1}&unionid={2}";
 
     private static final String WECHAT_AUTHORIZE_PATTERN = "{0}?appid={1}&redirect_uri={2}&response_type=code&scope=snsapi_login&state={3}#wechat_redirect";
     private static final String WECHAT_ACCESS_TOKEN_PATTERN = "{0}?appid={1}&secret={2}&code={3}&grant_type=authorization_code";
@@ -87,7 +87,7 @@ public class UrlBuilder {
     private static final String MICROSOFT_USER_INFO_PATTERN = "{0}";
     private static final String MICROSOFT_REFRESH_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&scope=user.read%20mail.read&redirect_uri={3}&refresh_token={4}&grant_type=refresh_token";
 
-    private static final String MI_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&response_type=code&scope=user/profile%20user/openIdV2%20user/phoneAndEmail&state={3}&skip_confirm=false";
+    private static final String MI_AUTHORIZE_PATTERN = "{0}?client_id={1}&redirect_uri={2}&response_type=code&scope=1%203%204%206&state={3}&skip_confirm=false";
     private static final String MI_ACCESS_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&redirect_uri={3}&code={4}&grant_type=authorization_code";
     private static final String MI_USER_INFO_PATTERN = "{0}?clientId={1}&token={2}";
     private static final String MI_REFRESH_TOKEN_PATTERN = "{0}?client_id={1}&client_secret={2}&redirect_uri={3}&refresh_token={4}&grant_type=refresh_token";
@@ -96,6 +96,15 @@ public class UrlBuilder {
     private static final String TOUTIAO_USER_INFO_PATTERN = "{0}?client_key={1}&access_token={2}";
     private static final String TOUTIAO_AUTHORIZE_PATTERN = "{0}?client_key={1}&redirect_uri={2}&state={3}&response_type=code&auth_only=1&display=0";
 
+    /**
+     * 获取state，如果为空， 则默认去当前日期的时间戳
+     *
+     * @param state state
+     */
+    private static Object getState(String state) {
+        return StringUtils.isEmpty(state) ? String.valueOf(System.currentTimeMillis()) : state;
+    }
+
     /**
      * 获取githubtoken的接口地址
      *
@@ -124,10 +133,11 @@ public class UrlBuilder {
      *
      * @param clientId    github 应用的Client ID
      * @param redirectUrl github 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getGithubAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GITHUB_AUTHORIZE_PATTERN, AuthSource.GITHUB.authorize(), clientId, redirectUrl);
+    public static String getGithubAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GITHUB_AUTHORIZE_PATTERN, AuthSource.GITHUB.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -158,10 +168,11 @@ public class UrlBuilder {
      *
      * @param clientId    weibo 应用的Client ID
      * @param redirectUrl weibo 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getWeiboAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(WEIBO_AUTHORIZE_PATTERN, AuthSource.WEIBO.authorize(), clientId, redirectUrl);
+    public static String getWeiboAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(WEIBO_AUTHORIZE_PATTERN, AuthSource.WEIBO.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -192,10 +203,11 @@ public class UrlBuilder {
      *
      * @param clientId    gitee 应用的Client ID
      * @param redirectUrl gitee 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return json
      */
-    public static String getGiteeAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GITEE_AUTHORIZE_PATTERN, AuthSource.GITEE.authorize(), clientId, redirectUrl);
+    public static String getGiteeAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GITEE_AUTHORIZE_PATTERN, AuthSource.GITEE.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -203,10 +215,11 @@ public class UrlBuilder {
      *
      * @param clientId    钉钉 应用的App Id
      * @param redirectUrl 钉钉 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getDingTalkQrConnectUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(DING_TALK_QRCONNECT_PATTERN, AuthSource.DINGTALK.authorize(), clientId, redirectUrl);
+    public static String getDingTalkQrConnectUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(DING_TALK_QRCONNECT_PATTERN, AuthSource.DINGTALK.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -249,10 +262,11 @@ public class UrlBuilder {
      *
      * @param clientId    baidu 应用的API Key
      * @param redirectUrl baidu 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return json
      */
-    public static String getBaiduAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(BAIDU_AUTHORIZE_PATTERN, AuthSource.BAIDU.authorize(), clientId, redirectUrl);
+    public static String getBaiduAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(BAIDU_AUTHORIZE_PATTERN, AuthSource.BAIDU.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -293,10 +307,11 @@ public class UrlBuilder {
      *
      * @param clientId    csdn 应用的Client ID
      * @param redirectUrl csdn 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getCsdnAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(CSDN_AUTHORIZE_PATTERN, AuthSource.CSDN.authorize(), clientId, redirectUrl);
+    public static String getCsdnAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(CSDN_AUTHORIZE_PATTERN, AuthSource.CSDN.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -326,10 +341,11 @@ public class UrlBuilder {
      *
      * @param clientId    coding 应用的Client ID
      * @param redirectUrl coding 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getCodingAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(CODING_AUTHORIZE_PATTERN, AuthSource.CODING.authorize(), clientId, redirectUrl);
+    public static String getCodingAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(CODING_AUTHORIZE_PATTERN, AuthSource.CODING.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -359,10 +375,11 @@ public class UrlBuilder {
      *
      * @param clientId    coding 应用的Client ID
      * @param redirectUrl coding 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getTencentCloudAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TENCENT_AUTHORIZE_PATTERN, AuthSource.TENCENT_CLOUD.authorize(), clientId, redirectUrl);
+    public static String getTencentCloudAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TENCENT_AUTHORIZE_PATTERN, AuthSource.TENCENT_CLOUD.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -393,10 +410,11 @@ public class UrlBuilder {
      *
      * @param clientId    oschina 应用的Client ID
      * @param redirectUrl oschina 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getOschinaAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(OSCHINA_AUTHORIZE_PATTERN, AuthSource.OSCHINA.authorize(), clientId, redirectUrl);
+    public static String getOschinaAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(OSCHINA_AUTHORIZE_PATTERN, AuthSource.OSCHINA.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -429,21 +447,23 @@ public class UrlBuilder {
      *
      * @param clientId    qq 应用的Client ID
      * @param redirectUrl qq 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getQqAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(QQ_AUTHORIZE_PATTERN, AuthSource.QQ.authorize(), clientId, redirectUrl, System.currentTimeMillis());
+    public static String getQqAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(QQ_AUTHORIZE_PATTERN, AuthSource.QQ.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
      * 获取qq授权地址
      *
-     * @param url   获取qqopenid的api接口地址
-     * @param token qq 应用授权的token
+     * @param url     获取qqopenid的api接口地址
+     * @param token   qq 应用授权的token
+     * @param unionid 是否需要获取unionid，默认为false。注：获取unionid需要单独发送邮件申请权限，请个人视情况而定。参考链接：http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D
      * @return full url
      */
-    public static String getQqOpenidUrl(String url, String token) {
-        return MessageFormat.format(QQ_OPENID_PATTERN, url, token);
+    public static String getQqOpenidUrl(String url, String token, boolean unionid) {
+        return MessageFormat.format(QQ_OPENID_PATTERN, url, token, unionid ? 1 : 0);
     }
 
     /**
@@ -451,10 +471,11 @@ public class UrlBuilder {
      *
      * @param clientId    alipay 应用的Client ID
      * @param redirectUrl alipay 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getAlipayAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(ALIPAY_AUTHORIZE_PATTERN, AuthSource.ALIPAY.authorize(), clientId, redirectUrl);
+    public static String getAlipayAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(ALIPAY_AUTHORIZE_PATTERN, AuthSource.ALIPAY.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -462,11 +483,11 @@ public class UrlBuilder {
      *
      * @param clientId    微信 应用的appid
      * @param redirectUrl 微信 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getWeChatAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(WECHAT_AUTHORIZE_PATTERN, AuthSource.WECHAT.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getWeChatAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(WECHAT_AUTHORIZE_PATTERN, AuthSource.WECHAT.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -521,11 +542,11 @@ public class UrlBuilder {
      *
      * @param clientId    Taobao 应用的Client ID
      * @param redirectUrl Taobao 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getTaobaoAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TAOBAO_AUTHORIZE_PATTERN, AuthSource.TAOBAO.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getTaobaoAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TAOBAO_AUTHORIZE_PATTERN, AuthSource.TAOBAO.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -533,11 +554,11 @@ public class UrlBuilder {
      *
      * @param clientId    google 应用的Client ID
      * @param redirectUrl google 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getGoogleAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(GOOGLE_AUTHORIZE_PATTERN, AuthSource.GOOGLE.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getGoogleAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(GOOGLE_AUTHORIZE_PATTERN, AuthSource.GOOGLE.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -568,11 +589,11 @@ public class UrlBuilder {
      *
      * @param clientId    Facebook 应用的Client ID
      * @param redirectUrl Facebook 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getFacebookAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(FACEBOOK_AUTHORIZE_PATTERN, AuthSource.FACEBOOK.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getFacebookAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(FACEBOOK_AUTHORIZE_PATTERN, AuthSource.FACEBOOK.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -603,11 +624,11 @@ public class UrlBuilder {
      *
      * @param clientId    Douyin 应用的Client ID
      * @param redirectUrl Douyin 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getDouyinAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(DOUYIN_AUTHORIZE_PATTERN, AuthSource.DOUYIN.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getDouyinAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(DOUYIN_AUTHORIZE_PATTERN, AuthSource.DOUYIN.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -649,11 +670,11 @@ public class UrlBuilder {
      *
      * @param clientId    Linkedin 应用的Client ID
      * @param redirectUrl Linkedin 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getLinkedinAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(LINKEDIN_AUTHORIZE_PATTERN, AuthSource.LINKEDIN.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getLinkedinAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(LINKEDIN_AUTHORIZE_PATTERN, AuthSource.LINKEDIN.authorize(), clientId, redirectUrl, state);
     }
 
     /**
@@ -695,11 +716,11 @@ public class UrlBuilder {
      *
      * @param clientId    微软 应用的Client ID
      * @param redirectUrl 微软 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getMicrosoftAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(MICROSOFT_AUTHORIZE_PATTERN, AuthSource.MICROSOFT.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getMicrosoftAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(MICROSOFT_AUTHORIZE_PATTERN, AuthSource.MICROSOFT.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -742,10 +763,11 @@ public class UrlBuilder {
      *
      * @param clientId    小米 应用的Client ID
      * @param redirectUrl 小米 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getMiAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(MI_AUTHORIZE_PATTERN, AuthSource.MI.authorize(), clientId, redirectUrl, System.currentTimeMillis());
+    public static String getMiAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(MI_AUTHORIZE_PATTERN, AuthSource.MI.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**
@@ -790,11 +812,11 @@ public class UrlBuilder {
      *
      * @param clientId    今日头条 应用的Client ID
      * @param redirectUrl 今日头条 应用授权成功后的回调地址
+     * @param state       随机字符串，用于保持会话状态，防止CSRF攻击
      * @return full url
      */
-    public static String getToutiaoAuthorizeUrl(String clientId, String redirectUrl) {
-        return MessageFormat.format(TOUTIAO_AUTHORIZE_PATTERN, AuthSource.TOUTIAO.authorize(), clientId, redirectUrl, System
-                .currentTimeMillis());
+    public static String getToutiaoAuthorizeUrl(String clientId, String redirectUrl, String state) {
+        return MessageFormat.format(TOUTIAO_AUTHORIZE_PATTERN, AuthSource.TOUTIAO.authorize(), clientId, redirectUrl, getState(state));
     }
 
     /**

src/test/java/me/zhyd/oauth/AuthRequestTest.java

@@ -1,6 +1,7 @@
 package me.zhyd.oauth;
 
 import me.zhyd.oauth.config.AuthConfig;
+import me.zhyd.oauth.model.AuthCallback;
 import me.zhyd.oauth.model.AuthResponse;
 import me.zhyd.oauth.request.*;
 import org.junit.Test;
@@ -18,11 +19,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -31,11 +33,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -45,10 +48,10 @@ public class AuthRequestTest {
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -57,11 +60,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -70,11 +74,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -83,11 +88,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -96,11 +102,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -109,11 +116,27 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void alipayTest() {
+        AuthRequest authRequest = new AuthAlipayRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .alipayPublicKey("publicKey")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -122,11 +145,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -135,11 +159,26 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void taobaoTest() {
+        AuthRequest authRequest = new AuthTaobaoRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -148,11 +187,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -161,11 +201,40 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void douyinTest() {
+        AuthRequest authRequest = new AuthDouyinRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void linkedinTest() {
+        AuthRequest authRequest = new AuthLinkedinRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -174,11 +243,12 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 
     @Test
@@ -187,10 +257,25 @@ public class AuthRequestTest {
                 .clientId("clientId")
                 .clientSecret("clientSecret")
                 .redirectUri("redirectUri")
+                .state("state")
                 .build());
-        // 返回授权页面，可自行调整
+        // 返回授权页面，可自行跳转
         String url = authRequest.authorize();
-        // 授权登录后会返回一个code，用这个code进行登录
-        AuthResponse login = authRequest.login("code");
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
+    }
+
+    @Test
+    public void toutiaoTest() {
+        AuthRequest authRequest = new AuthToutiaoRequest(AuthConfig.builder()
+                .clientId("clientId")
+                .clientSecret("clientSecret")
+                .redirectUri("redirectUri")
+                .state("state")
+                .build());
+        // 返回授权页面，可自行跳转
+        String url = authRequest.authorize();
+        // 授权登录后会返回code（auth_code（仅限支付宝））、state，1.8.0版本后，可以用AuthCallback类作为回调接口的入参
+        AuthResponse login = authRequest.login(new AuthCallback());
     }
 }

src/test/java/me/zhyd/oauth/utils/AuthStateTest.java

@@ -0,0 +1,231 @@
+package me.zhyd.oauth.utils;
+
+import cn.hutool.core.date.DatePattern;
+import cn.hutool.core.date.DateUtil;
+import me.zhyd.oauth.config.AuthConfig;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.*;
+
+public class AuthStateTest {
+
+    /**
+     * step1 生成state: 预期创建一个新的state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9yM3ll
+     *
+     * step2 重复生成state: 预期从bucket中返回一个可用的state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9yM3ll
+     *
+     * step3 获取state: 预期获取上面生成的state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9yM3ll
+     *
+     * step4 删除state: 预期删除掉上面创建的state...
+     *
+     * step5 重新获取state: 预期返回null...
+     * null
+     */
+    @Test
+    public void test() {
+        String source = "github";
+        System.out.println("\nstep1 生成state: 预期创建一个新的state...");
+        String state = AuthState.create(source);
+        System.out.println(state);
+
+        System.out.println("\nstep2 重复生成state: 预期从bucket中返回一个可用的state...");
+        String recreateState = AuthState.create(source);
+        System.out.println(recreateState);
+        Assert.assertEquals(state, recreateState);
+
+        System.out.println("\nstep3 获取state: 预期获取上面生成的state...");
+        String stateByBucket = AuthState.get(source);
+        System.out.println(stateByBucket);
+        Assert.assertEquals(state, stateByBucket);
+
+        System.out.println("\nstep4 删除state: 预期删除掉上面创建的state...");
+        AuthState.delete(source);
+
+        System.out.println("\nstep5 重新获取state: 预期返回null...");
+        String deletedState = AuthState.get(source);
+        System.out.println(deletedState);
+        Assert.assertNull(deletedState);
+    }
+
+    /**
+     * 通过随机字符串生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9wdnAy
+     *
+     * 通过传入自定义的字符串生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV/ov5nmmK/kuIDkuKrlrZfnrKbkuLI=
+     *
+     * 通过传入数字生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV8xMTE=
+     *
+     * 通过传入日期生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV8xNTQ2MzE1OTMyMDAw
+     *
+     * 通过传入map生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV97InVzZXJUb2tlbiI6Inh4eHh4IiwidXNlcklkIjoxfQ==
+     *
+     * 通过传入List生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9bInh4eHgiLCJ4eHh4eHh4eCJd
+     *
+     * 通过传入实体类生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV97ImNsaWVudElkIjoieHh4eHgiLCJjbGllbnRTZWNyZXQiOiJ4eHh4eCIsInVuaW9uSWQiOmZhbHNlfQ==
+     */
+    @Test
+    public void create() {
+        String source = "github";
+        System.out.println("\n通过随机字符串生成state...");
+        String state = AuthState.create(source);
+        System.out.println(state);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入自定义的字符串生成state...");
+        String stringBody = "这是一个字符串";
+        String stringState = AuthState.create(source, stringBody);
+        System.out.println(stringState);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入数字生成state...");
+        Integer numberBody = 111;
+        String numberState = AuthState.create(source, numberBody);
+        System.out.println(numberState);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入日期生成state...");
+        Date dateBody = DateUtil.parse("2019-01-01 12:12:12", DatePattern.NORM_DATETIME_PATTERN);
+        String dateState = AuthState.create(source, dateBody);
+        System.out.println(dateState);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入map生成state...");
+        Map<String, Object> mapBody = new HashMap<>();
+        mapBody.put("userId", 1);
+        mapBody.put("userToken", "xxxxx");
+        String mapState = AuthState.create(source, mapBody);
+        System.out.println(mapState);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入List生成state...");
+        List<String> listBody = new ArrayList<>();
+        listBody.add("xxxx");
+        listBody.add("xxxxxxxx");
+        String listState = AuthState.create(source, listBody);
+        System.out.println(listState);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入实体类生成state...");
+        AuthConfig entityBody = AuthConfig.builder()
+                .clientId("xxxxx")
+                .clientSecret("xxxxx")
+                .build();
+        String entityState = AuthState.create(source, entityBody);
+        System.out.println(entityState);
+        AuthState.delete(source);
+    }
+
+    /**
+     * 通过随机字符串生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9kaWNn
+     * dicg
+     *
+     * 通过传入自定义的字符串生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV/ov5nmmK/kuIDkuKrlrZfnrKbkuLI=
+     * 这是一个字符串
+     *
+     * 通过传入数字生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV8xMTE=
+     * 111
+     *
+     * 通过传入日期生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV8xNTQ2MzE1OTMyMDAw
+     * Tue Jan 01 12:12:12 CST 2019
+     *
+     * 通过传入map生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV97InVzZXJUb2tlbiI6Inh4eHh4IiwidXNlcklkIjoxfQ==
+     * {userToken=xxxxx, userId=1}
+     *
+     * 通过传入List生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV9bInh4eHgiLCJ4eHh4eHh4eCJd
+     * [xxxx, xxxxxxxx]
+     *
+     * 通过传入实体类生成state...
+     * Z2l0aHViXzE5Mi4xNjguMTkuMV97ImNsaWVudElkIjoieHh4eHgiLCJjbGllbnRTZWNyZXQiOiJ4eHh4eCIsInVuaW9uSWQiOmZhbHNlfQ==
+     * me.zhyd.oauth.config.AuthConfig@725bef66
+     */
+    @Test
+    public void getBody() {
+        String source = "github";
+        System.out.println("\n通过随机字符串生成state...");
+        String state = AuthState.create(source);
+        System.out.println(state);
+        String body = AuthState.getBody(source, state, String.class);
+        System.out.println(body);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入自定义的字符串生成state...");
+        String stringBody = "这是一个字符串";
+        String stringState = AuthState.create(source, stringBody);
+        System.out.println(stringState);
+        stringBody = AuthState.getBody(source, stringState, String.class);
+        System.out.println(stringBody);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入数字生成state...");
+        Integer numberBody = 111;
+        String numberState = AuthState.create(source, numberBody);
+        System.out.println(numberState);
+        numberBody = AuthState.getBody(source, numberState, Integer.class);
+        System.out.println(numberBody);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入日期生成state...");
+        Date dateBody = DateUtil.parse("2019-01-01 12:12:12", DatePattern.NORM_DATETIME_PATTERN);
+        String dateState = AuthState.create(source, dateBody);
+        System.out.println(dateState);
+        dateBody = AuthState.getBody(source, dateState, Date.class);
+        System.out.println(dateBody);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入map生成state...");
+        Map<String, Object> mapBody = new HashMap<>();
+        mapBody.put("userId", 1);
+        mapBody.put("userToken", "xxxxx");
+        String mapState = AuthState.create(source, mapBody);
+        System.out.println(mapState);
+        mapBody = AuthState.getBody(source, mapState, Map.class);
+        System.out.println(mapBody);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入List生成state...");
+        List<String> listBody = new ArrayList<>();
+        listBody.add("xxxx");
+        listBody.add("xxxxxxxx");
+        String listState = AuthState.create(source, listBody);
+        System.out.println(listState);
+        listBody = AuthState.getBody(source, listState, List.class);
+        System.out.println(listBody);
+        AuthState.delete(source);
+
+        System.out.println("\n通过传入实体类生成state...");
+        AuthConfig entityBody = AuthConfig.builder()
+                .clientId("xxxxx")
+                .clientSecret("xxxxx")
+                .build();
+        String entityState = AuthState.create(source, entityBody);
+        System.out.println(entityState);
+        entityBody = AuthState.getBody(source, entityState, AuthConfig.class);
+        System.out.println(entityBody);
+        AuthState.delete(source);
+    }
+
+    @Test
+    public void getErrorStateBody() {
+        String source = "github";
+        String state = "1111111111111111111111111111111";
+        String body = AuthState.getBody(source, state, String.class);
+        System.out.println(body);
+        AuthState.delete(source);
+    }
+}

src/test/java/me/zhyd/oauth/utils/GlobalAuthUtilTest.java

@@ -0,0 +1,61 @@
+package me.zhyd.oauth.utils;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class GlobalAuthUtilTest {
+
+    @Test
+    public void testGenerateDingTalkSignature() {
+        Assert.assertEquals("mLTZEMqIlpAA3xtJ43KcRT0EDLwgSamFe%2FNis5lq9ik%3D",
+                GlobalAuthUtil.generateDingTalkSignature(
+                        "SHA-256", "1562325753000 "));
+    }
+
+    @Test
+    public void testUrlDecode() {
+        Assert.assertEquals("", GlobalAuthUtil.urlDecode(null));
+        Assert.assertEquals("https://www.foo.bar",
+                GlobalAuthUtil.urlDecode("https://www.foo.bar"));
+        Assert.assertEquals("mLTZEMqIlpAA3xtJ43KcRT0EDLwgSamFe/Nis5lq9ik=",
+                GlobalAuthUtil.urlDecode(
+                        "mLTZEMqIlpAA3xtJ43KcRT0EDLwgSamFe%2FNis5lq9ik%3D"));
+    }
+
+    @Test
+    public void testParseStringToMap() {
+        Map expected = new HashMap();
+        expected.put("bar", "baz");
+        Assert.assertEquals(expected,
+                GlobalAuthUtil.parseStringToMap("foo&bar=baz"));
+    }
+
+    @Test
+    public void testIsHttpProtocol() {
+        Assert.assertFalse(GlobalAuthUtil.isHttpProtocol(""));
+        Assert.assertFalse(GlobalAuthUtil.isHttpProtocol("foo"));
+
+        Assert.assertTrue(GlobalAuthUtil.isHttpProtocol("http://www.foo.bar"));
+    }
+
+    @Test
+    public void testIsHttpsProtocol() {
+        Assert.assertFalse(GlobalAuthUtil.isHttpsProtocol(""));
+        Assert.assertFalse(GlobalAuthUtil.isHttpsProtocol("foo"));
+
+        Assert.assertTrue(
+                GlobalAuthUtil.isHttpsProtocol("https://www.foo.bar"));
+    }
+
+    @Test
+    public void testIsLocalHost() {
+        Assert.assertFalse(GlobalAuthUtil.isLocalHost("foo"));
+
+        Assert.assertTrue(GlobalAuthUtil.isLocalHost(""));
+        Assert.assertTrue(GlobalAuthUtil.isLocalHost("127.0.0.1"));
+        Assert.assertTrue(GlobalAuthUtil.isLocalHost("localhost"));
+    }
+}

update.md

@@ -1,3 +1,21 @@
+### 2019/07/15
+1. 新增 `AuthState` 类，内置默认的state生成规则和校验规则
+
+### 2019/07/12
+1. 合并[Braavos96](https://github.com/Braavos96)提交的[PR#16](https://github.com/zhangyd-c/JustAuth/pull/16)
+
+### 2019/06/28
+1. 修复百度登录获取不到token失效时间的问题
+2. 增加state参数校验，预防CSRF。**强烈建议启用state**！
+
+### 2019/06/27
+1. 修改login方法的参数为AuthCallback，封装回调返回的参数
+2. 支持state参数
+3. 增加code和state参数校验
+
+### 2019/06/25
+qq授权登录时，需要获取`openId`作为`uuid`，在`1.6.1-beta`和`1.7.0`版本中，引入了`unionId`这一属性。获取`unionid`需要单独向qq团队**发送邮件**申请权限，鉴于这一申请权限的步骤比较麻烦（需要填写的内容比较多），所以在`AuthConfig`中增加了一个`unionId`属性，当为**true**时才会获取unionid，当为false时只获取openId。如果你需要该功能， 则在自行申请了相关权限后，将该属性置为true即可。关于unionId的参考链接：[UnionID介绍](http://wiki.connect.qq.com/unionid%E4%BB%8B%E7%BB%8D)
+
 ### 2019/06/19
 1. 合并[xkcoding](https://github.com/xkcoding)提交的[PR](https://github.com/zhangyd-c/JustAuth/pull/14)，重构了部分代码，jar包由原来的`130+kb`优化到现在的`110+kb`
 2. 合并[skqing](https://gitee.com/skqing)提交的[PR](https://gitee.com/yadong.zhang/JustAuth/pulls/3)， 解决抖音登录失败问题