How to generate a random, non-guessable string for the "state" parameter in OAuth using Node.js?

Question

I'm building a simple website and want to implement OAuth for authentication.

I've read that including a "state" parameter in the authorization request is necessary to prevent CSRF attacks. However, I'm not sure if my implementation to achieve protection from CSRF attack using the state parameter is correct.

To prevent CSRF attacks, I'm considering the following approach:

1. Generate a random string.
2. Encrypt the string and store it in an httpOnly cookie so that I can retrieve it later.
3. Hash the string and provide it in the front end to pass the hash value to the authorization server as a state.
4. When the authorization server passes the "state" parameter back to the callback URL, compare the hashed value to the original string retrieved from the cookie.

Any guidance or examples would be greatly appreciated. Thank you!