Good implementations make use of state and nonce parameters to prevent attacks e.g. state parameter used to tie it to the browser (prevent CSRF attack):

1. User visits OAuth application (signed out)

2. Application sets secure cookie with a state value (cookies are set to the Apps host)

3. Application redirects to Visma Connect IdP with state parameter in the Authorize-request

4. User logs in with Visma Connect IdP

5. Visma Connect IdP redirects back to Application via pre-registered OAuth redirectURI

6. Application validates OAuth state, comparing cookie value to state value from Visma Connect IdP callback

7. Application approves or rejects OAuth callback