var uid = require('uid2');

/**
 * Creates an instance of `SessionStateProvider`.
 *
 * This is the default state provider implementation for the OAuth2Strategy.
 * If generates a random state and stores it in `req.session` under the `key`
 * provided in the constructor.
 *
 * If no session exists, the provider will throw an error. If you are not using
 * sessions, consider using `TokenStateProvider` instead.
 *
 * Options:
 *
 *   - `key`               The key in the session under which to store the session state
 *
 * @constructor
 * @param {Object} options
 * @api public
 */
function SessionStore(options) {
  if (!options.key) { throw new TypeError('SessionStateStore requires a key'); }
  this._key = options.key;
}

/**
 * Given a request, returns a value to use as state.
 *
 * This implementation simply generates a random UID and stores the value in the session
 * for validation at a later stage when `verify` is called.
 *
 * @param {Object} req
 * @param {Function} callback
 * @api protected
 */
SessionStore.prototype.store = function(req, callback) {
  if (!req.session) { return callback(new Error('OAuth2Strategy requires session support when using state. Did you forget app.use(express.session(...))?')); }

  var key = this._key;
  var state = uid(24);
  if (!req.session[key]) { req.session[key] = {}; }
  req.session[key].state = state;
  callback(null, state);
};

/**
 * Given a request, and the state returned by the OAuth provider, verifies the state.
 *
 * This implementation simply compares the returned state to the one saved in the user's session.
 * If they do not match, or no state is saved in the session, the call will fail.
 * If there is no session, the call will return an error.
 *
 * The callback signature has two values (`err`, `failureCode`). On success, these are both
 * undefined. On error, only `err` is definied and on failure, err will contain the failure object
 * while `failureCode` will contain the failure code.
 *
 * @param {Object} req
 * @param {String} providedState
 * @param {Function} callback
 * @api protected
 */
SessionStore.prototype.verify = function(req, providedState, callback) {
  if (!req.session) { return callback(new Error('OAuth2Strategy requires session support when using state. Did you forget app.use(express.session(...))?')); }

  var key = this._key;
  if (!req.session[key]) {
   return callback(null, false, { message: 'Unable to verify authorization request state.' });
  }

  var state = req.session[key].state;
  if (!state) {
   return callback(null, false, { message: 'Unable to verify authorization request state.' });
  }

  delete req.session[key].state;
  if (Object.keys(req.session[key]).length === 0) {
   delete req.session[key];
  }

  if (state !== providedState) {
   return callback(null, false, { message: 'Invalid authorization request state.' });
  }

  return callback(null, true);
};

/**
 * Expose `SessionStateProvider`.
 */
module.exports = SessionStore;

@@ -57,35 +57,27 @@
 f %60SessionSt
-ateProvider
+ore
 %60.%0A *%0A * Thi
@@ -89,30 +89,19 @@
 the 
-default state provider
+state store
  imp
@@ -134,23 +134,64 @@
 Strategy
-.%0A * If
+ used when%0A * the %60state%60 option is enabled.  It
  generat
@@ -224,16 +224,19 @@
 es it in
+%0A *
  %60req.se
@@ -246,195 +246,195 @@
 on%60 
-under the %60key%60%0A * provided in the constructor.%0A *%0A * If no session exists, the provider will throw an err
+and verifies it when the service provider redirects the user%0A * back to the application.%0A *%0A * This state store requires session supp
 or
+t
 .
+ 
  If 
-you are not using%0A * sessions, consider using %60TokenStateProvider%60 instead
+no session exists, an error%0A * will be thrown
 .%0A *
@@ -461,29 +461,16 @@
  - %60key%60
-             
   The ke
@@ -511,24 +511,16 @@
 ore the 
-session 
 state%0A *
@@ -733,31 +733,29 @@
 %0A/**%0A * 
-Given a
+Store
  request
 , return
@@ -750,35 +750,8 @@
 uest
-, returns a value to use as
  sta
@@ -810,11 +810,14 @@
 dom 
-UID
+string
  and
@@ -836,16 +836,19 @@
 value in
+%0A *
  the ses
@@ -855,67 +855,103 @@
 sion
-%0A * for validation at a later stage when %60verify%60 is called
+, where it will be used for verification when the user is%0A * redirected back to the application
 .%0A *
@@ -1415,23 +1415,22 @@
 %0A * 
-Given a
+Verify
  request
 , an
@@ -1429,563 +1429,152 @@
 uest
-, and the state returned by the OAuth provider, verifies the state.%0A *%0A * This implementation simply compares the returned state to the one saved in the user's session.%0A * If they do not match, or no state is saved in the session, the call will fail.%0A * If there is no session, the call will return an error.%0A *%0A * The callback signature has two values (%60err%60, %60failureCode%60). On success, these are both%0A * undefined. On error, only %60err%60 is definied and on failure, err will contain the failure object%0A * while %60failureCode%60 will contain the failure code
+ state.%0A *%0A * This implementation simply compares the state parameter in the request to the%0A * value generated earlier and stored in the session
 .%0A *
@@ -2501,21 +2501,17 @@
 ;%0A%0A/
-**%0A *
+/
  Expose 
 %60Ses
@@ -2510,35 +2510,20 @@
 ose 
-%60SessionStateProvider%60.%0A */
+constructor.
 %0Amod

Clarify comments.