CSRF: Understanding the Attack From First Principles

While building an OIDC Provider, I came across something called the state parameter in the authorization flow. At first, I thought: Why do we need another random value? We already have an authorizati