服务器端应用程序的Google+登录

Question

Was going through the google tutorial page for implementing "Google+ Sign-In" for server-side apps.While proceeding in the tutorial ,I am stucked in Step 2 that says : Create an anti-request forgery state token .Below is the link for the tutorial :

https://developers.google.com/+/web/signin/server-side-flow

The tutorial says,I need to create the "unique session token" using below code.However I am wondering where do I need to place this code. In my index.html (which contains the sign in button) file ?? or something else.

  $state = md5(rand());
  $app['session']->set('state', $state);
  // Set the client ID, token state, and application name in the HTML while
  // serving it.
  return $app['twig']->render('index.html', array(
  'CLIENT_ID' => CLIENT_ID,
  'STATE' => $state,
  'APPLICATION_NAME' => APPLICATION_NAME
  ));  

Answer 1

The CLIENT_ID, STATE, and APPLICATION_NAME go on every page that has the javascript for the sign-in button.

The STATE must be unique per session and must be consistent within a session, which is why it's generated using the hash of some random data and saved throughout the session.