@Test
    void verifyUnchangedStateAndNonceParameter() throws Throwable {
        assertEquals(Ordered.LOWEST_PRECEDENCE, oauthAuthorizationCodeResponseBuilder.getOrder());

        val registeredService = getRegisteredService("example", CLIENT_SECRET, new LinkedHashSet<>());
        registeredService.setJwtAccessToken(true);
        servicesManager.save(registeredService);

        val service = RegisteredServiceTestUtils.getService("example");
        val attributes = new HashMap<String, List<Object>>();
        attributes.put(OAuth20Constants.STATE, List.of(STATE));
        attributes.put(OAuth20Constants.NONCE, List.of(NONCE));

        val holder = AccessTokenRequestContext
            .builder()
            .clientId(registeredService.getClientId())
            .service(service)
            .authentication(RegisteredServiceTestUtils.getAuthentication(RegisteredServiceTestUtils.getPrincipal(ID), attributes))
            .registeredService(registeredService)
            .grantType(OAuth20GrantTypes.NONE)
            .responseType(OAuth20ResponseTypes.TOKEN)
            .ticketGrantingTicket(new MockTicketGrantingTicket(ID))
            .generateRefreshToken(true)
            .redirectUri("https://oauth.example.org")
            .build();
        val modelAndView = oauthTokenResponseBuilder.build(holder);
        assertInstanceOf(RedirectView.class, modelAndView.getView(), "Expected RedirectView");
        assertTrue(modelAndView.getModel().isEmpty());

        val redirectUrl = ((AbstractUrlBasedView) modelAndView.getView()).getUrl();
        val params = splitQuery(redirectUrl.substring(redirectUrl.indexOf('#') + 1));

        verifyParam(params, OAuth20Constants.STATE, STATE);
        verifyParam(params, OAuth20Constants.NONCE, NONCE);
    }
This is {@link OAuth20TokenAuthorizationResponseBuilderTests}.

@author David Albrecht
@since 6.1.3
support/cas-server-support-oauth/src/test/java/org/apereo/cas/support/oauth/web/response/callback/OAuth20TokenAuthorizationResponseBuilderTests.java