Dear @Salesforce Identity , @Itzik Koren ,

We're using a Named Credential + OAuth/Open ID-based Auth. Provider to authorize a callout from SFDC to a 3rd-party service. Whatever Auth. Provider I use seem to stubbornly require a callback to include the state parameter.

I'm aware it's the best practice and that security comes first at SFDC, but how can we authorize our callouts when the 3rd-party's IdP is not capable of providing back the state we sent it first (not on their roadmap)?

(handleCallback() of Auth.AuthProviderPluginClass is not even getting called if there's no state in the callback.)

Poignant is the 3rd-party is actually a leading bank group... SFDC is more secure than a bank and I like it!

1. Is there a way I don't see how to take the risks and make use of an Auth. Provider when there's no state in the callback?
2. Would you consider allowing such a configuration in the future improvements around Open ID / OAuth capabilities of Salesforce?

Thank you!