When user is first time requested to authorize oauth

the state parameter is not returned in the callback

There was similar issue https://issues.redhat.com/browse/PROJQUAY-3139, but it seems to be fixed only when user already authorized and is not redirected into "Authorize" page.

I don't know the quay codebase, but it looks like state param is missing here https://github.com/quay/quay/blob/master/endpoints/web.py#L728 so Authorize page does not have it at all and can't send it back to callback.