Good afternoon Please clarify to me how the state parameter in the URL protects when using oauth 2.0.

1. When a client wants to authenticate in My Django application, it issues a request to the oauth server with an encrypted or signed state parameter.
2. On the authentication server, the client enters the username and password and if they match, the authentication server redirects the client back to my application using a GET request containing the “code” parameter and the same state .
3. My application receives this request, checks the state and sends a new request to the authentication server containing the “code”, state and secret (which I received in advance from the administration of the authentication server).
4. The authentication server checks the secret and state and issues an access token to my application.
   Question: What function does state perform? If I understand correctly, between steps 1 and 2 my request can be intercepted and state can simply be easily copied, even in encrypted form, and pasted into a fake request. The authentication server does not check the state for a signature and does not try to decrypt it… What does it protect against?

I try tio understand how it works