SocialAuthenticationFilter filter does not validate state

[dlvenable]

The Spring Social demos indicate that using SocialAuthenticationFilter is the preferred way to integrate with Spring Security. Indeed I find it integrates better with Spring Security than using ProviderSignInController. However, the code in SocialAuthenticationFilter doesn't validate the state parameter from Social providers. Thus using it for sign-in appears to open up a security hole.

I'm using Spring Security 1.1.4 and have been able to perform authentication into a simple system with a state which the server requesting Social sign-in never created.

[dlvenable]

I'd like to follow up on this issue. The OAuth2 spec recommends validating the state parameter.