@sova Thanks for asking, but no, i didn't.

I switched back to the original ring-oauth2 since I had replaced it with a clone with debugging statements just to make sure that I have not disrupted anything.

The code is

(let [settings (-> site-defaults
                   (assoc-in [:session :cookie-attrs :same-site] :lax))]
  (run-jetty
   (wrap-params (wrap-oauth2 (wrap-defaults handler settings) authmap)) 
   {:port 3000}))

It returns

State mismatch

I do not have enough understanding of ring, compojure to know where to place ring-oauth. I spend yesterday reading the code of ring, compojure and ring-oauth.

If you're already using wrap-defaults I don't think you need wrap-params as well -- but it's likely that you need to swap wrap-defaults and wrap-oauth2 since the latter probably relies on some stuff in the former for setup.

@magra Ring middleware is executed from the outside-in for requests and from the inside-out for responses.

Since wrap-oauth2 looks to depend on :session data, it will need the session middleware executed first and that's part of the defaults so you will want (run-jetty (wrap-defaults (wrap-oauth2 handler authmap) settings) {:port 3000})