fix: CSRF vulnerability in GitHub auth callback

[Mirza-Samad-Ahmed-Baig]

Problem
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the GitHub authentication callback handler at /api/auth/github/callback.
The application failed to properly validate the state parameter when the corresponding state cookie was missing.
This created a potential attack vector where a malicious actor could trick a user into authorizing the application, leading to unauthorized access to user accounts.

Solution
The authentication logic was updated to strictly validate both the presence and correctness of the state parameter.

Previous logic:
if (storedState and state is not equal to storedState)

Updated logic:
if (storedState is missing or state is not equal to storedState)

Impact
This update significantly improves the security of the GitHub OAuth flow. The benefits include:
Prevention of Cross-Site Request Forgery (CSRF) attacks
Blocking of unauthorized access through malicious authentication attempts
Ensuring only properly validated login flows are accepted

[vercel]

@Mirza-Samad-Ahmed-Baig is attempting to deploy a commit to the LangChain Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
open-swe-web	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 8, 2025 7:33pm
open-swe-web-langgraph	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 8, 2025 7:33pm