docs: update oauth2.md

docs/schemes/oauth2.md

@@ -18,12 +18,17 @@ auth: {
       token_type: 'Bearer',
       redirect_uri: undefined,
       client_id: 'SET_ME',
-      token_key: 'access_token'
+      token_key: 'access_token',
+      state: 'UNIQUE_AND_NON_GUESSABLE'
     }
   }
 }
 ```
 
+```js
+this.$auth.loginWith('social')
+```
+
 ### `authorization_endpoint`
 
 **REQUIRED** - Endpoint to start login flow. Depends on oauth service.
@@ -64,8 +69,8 @@ By default is set to `token_key: 'access_token'`. If you need to use the IdToken
 
 By default is set to `refresh_token_key: 'refresh_token'`. It automatically store the refresh_token, if it exists.
 
-## Usage
+### `state`
+
+ By default is set to random generated string.
+The primary reason for using the state parameter is to mitigate CSRF attacks. ([read more](https://auth0.com/docs/protocols/oauth2/oauth-state))
 
-```js
-this.$auth.loginWith('social')
-```