I'm following this tutorial to create a sign-in button.

<https://developers.google.com/+/web/signin/server-side-flow>

But I don't see how the anti-forgery state is passed to the button snippet (step 4).

Should there be a parameter like data-state for the button?

The whole tutorial doesn't mention how the state code is passed from the page to google server and back to my signInCallback function.

```
<div id="signinButton">
  <span class="g-signin"
        data-scope="https://www.googleapis.com/auth/plus.login"
        data-clientid="YOUR_CLIENT_ID"
        data-redirecturi="postmessage"
        data-accesstype="offline"
        data-cookiepolicy="single_host_origin"
        data-callback="signInCallback">
  </span>
</div>

```

Then in step 6, I don't see how the state is passed to the ajax server call. So how does this if-condition work in step 7?

> 
> if request.args.get('state', '') != session['state']:
> 
> 
> 

Thanks for any help in advance.