diff --git a/admin/oauth2callback.php b/admin/oauth2callback.php
index 364c0023de0..c032a9c2f16 100644
--- a/admin/oauth2callback.php
+++ b/admin/oauth2callback.php
@@ -33,6 +33,14 @@ require_once(dirname(dirname(__FILE__)).'/config.php');
 // The authorization code generated by the authorization server.
 $code = required_param('code', PARAM_RAW);
 // The state parameter we've given (used in moodle as a redirect url).
-$state = required_param('state', PARAM_URL);
+$state = required_param('state', PARAM_LOCALURL);
 
-redirect(new moodle_url($state, array('code' => $code)));
+$redirecturl = new moodle_url($state);
+$params = $redirecturl->params();
+
+if (isset($params['sesskey']) and confirm_sesskey($params['sesskey'])) {
+    $redirecturl->param('oauth2code', $code);
+    redirect($redirecturl);
+} else {
+    print_error('invalidsesskey');
+}
diff --git a/lib/oauthlib.php b/lib/oauthlib.php
index b4aa15b7500..587ba195b60 100644
--- a/lib/oauthlib.php
+++ b/lib/oauthlib.php
@@ -368,8 +368,8 @@ abstract class oauth2_client extends curl {
     private $clientid = '';
     /** var string The client secret. */
     private $clientsecret = '';
-    /** var string URL to return to after authenticating */
-    private $returnurl = '';
+    /** var moodle_url URL to return to after authenticating */
+    private $returnurl = null;
     /** var string scope of the authentication request */
     private $scope = '';
     /** var stdClass access token object */
@@ -392,10 +392,10 @@ abstract class oauth2_client extends curl {
      *
      * @param string $clientid
      * @param string $clientsecret
-     * @param string $returnurl
+     * @param moodle_url $returnurl
      * @param string $scope
      */
-    public function __construct($clientid, $clientsecret, $returnurl, $scope) {
+    public function __construct($clientid, $clientsecret, moodle_url $returnurl, $scope) {
         parent::__construct();
         $this->clientid = $clientid;
         $this->clientsecret = $clientsecret;
@@ -425,7 +425,7 @@ abstract class oauth2_client extends curl {
 
         // If we've been passed then authorization code generated by the
         // authorization server try and upgrade the token to an access token.
-        $code = optional_param('code', null, PARAM_RAW);
+        $code = optional_param('oauth2code', null, PARAM_RAW);
         if ($code && $this->upgrade_token($code)) {
             return true;
         }
@@ -456,7 +456,7 @@ abstract class oauth2_client extends curl {
                         array('client_id' => $this->clientid,
                               'response_type' => 'code',
                               'redirect_uri' => $callbackurl->out(false),
-                              'state' => $this->returnurl,
+                              'state' => $this->returnurl->out_as_local_url(false),
                               'scope' => $this->scope,
                           ));
 
diff --git a/portfolio/googledocs/lib.php b/portfolio/googledocs/lib.php
index 9820246f9db..02ce15910ef 100644
--- a/portfolio/googledocs/lib.php
+++ b/portfolio/googledocs/lib.php
@@ -124,7 +124,7 @@ class portfolio_plugin_googledocs extends portfolio_plugin_push_base {
         $clientid = $this->get_config('clientid');
         $secret = $this->get_config('secret');
 
-        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl->out(false), google_docs::REALM);
+        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl, google_docs::REALM);
     }
 
     public function instance_sanity_check() {
diff --git a/portfolio/picasa/lib.php b/portfolio/picasa/lib.php
index d637b54edca..70200c13af8 100644
--- a/portfolio/picasa/lib.php
+++ b/portfolio/picasa/lib.php
@@ -124,7 +124,7 @@ class portfolio_plugin_picasa extends portfolio_plugin_push_base {
         $clientid = $this->get_config('clientid');
         $secret = $this->get_config('secret');
 
-        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl->out(false), google_picasa::REALM);
+        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl, google_picasa::REALM);
     }
 
     public function instance_sanity_check() {
diff --git a/repository/googledocs/lib.php b/repository/googledocs/lib.php
index 6ccb33bc436..df0f23eb0ff 100644
--- a/repository/googledocs/lib.php
+++ b/repository/googledocs/lib.php
@@ -39,12 +39,14 @@ class repository_googledocs extends repository {
     public function __construct($repositoryid, $context = SYSCONTEXTID, $options = array()) {
         parent::__construct($repositoryid, $context, $options);
 
-        $returnurl = new moodle_url('/repository/repository_callback.php',
-            array('callback' => 'yes', 'repo_id' =>$this->id));
+        $returnurl = new moodle_url('/repository/repository_callback.php');
+        $returnurl->param('callback', 'yes');
+        $returnurl->param('repo_id', $this->id);
+        $returnurl->param('sesskey', sesskey());
 
         $clientid = get_config('googledocs', 'clientid');
         $secret = get_config('googledocs', 'secret');
-        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl->out(false), google_docs::REALM);
+        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl, google_docs::REALM);
 
         $this->check_login();
     }
diff --git a/repository/picasa/lib.php b/repository/picasa/lib.php
index 902238025fa..0d0b63c0cfa 100644
--- a/repository/picasa/lib.php
+++ b/repository/picasa/lib.php
@@ -41,12 +41,14 @@ class repository_picasa extends repository {
     public function __construct($repositoryid, $context = SYSCONTEXTID, $options = array()) {
         parent::__construct($repositoryid, $context, $options);
 
-        $returnurl = new moodle_url('/repository/repository_callback.php',
-            array('callback' => 'yes', 'repo_id' =>$this->id));
+        $returnurl = new moodle_url('/repository/repository_callback.php');
+        $returnurl->param('callback', 'yes');
+        $returnurl->param('repo_id', $this->id);
+        $returnurl->param('sesskey', sesskey());
 
         $clientid = get_config('picasa', 'clientid');
         $secret = get_config('picasa', 'secret');
-        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl->out(false), google_picasa::REALM);
+        $this->googleoauth = new google_oauth($clientid, $secret, $returnurl, google_picasa::REALM);
 
         $this->check_login();
     }