Preserve custom state after redirect

I need to preserve state after redirecting (eg, using a custom parameter), but it seems the state parameter is currently only used for CSRF token. Is there another way to preserve state?

No file, test, or entry point is named. Start by locating the OAuth authorization redirect and state handling, then review related tests and documentation. Done should be a decided, documented, and tested way to preserve caller state across the redirect while retaining CSRF protection.

Vom Indexierungsmodell aus dem Issue-Text verfasst.