public void verifyState(HttpRequest request, HttpResponse response, OAuth2IdentityProvider provider) {
    verifyState(request, response, provider, DEFAULT_STATE_PARAMETER_NAME);
  }
@Test
  public void fail_with_AuthenticationException_when_state_parameter_is_empty() {
    when(request.getCookies()).thenReturn(new Cookie[]{wrapCookie("OAUTHSTATE", sha1Hex("state"))});
    when(request.getParameter("state")).thenReturn("");

    assertThatThrownBy(() -> underTest.verifyState(request, response, identityProvider))
      .hasMessage("CSRF state value is invalid")
      .isInstanceOf(AuthenticationException.class)
      .hasFieldOrPropertyWithValue("source", AuthenticationEvent.Source.oauth2(identityProvider));
  }