I have found the real reason. For this entire OAuth flow to correctly happen the public client must be the first actor in the chain of OAuth flow. In other words it must start the flow, not the backend. By doing so, client generates a state on it's side and stores it whenever it's needed (for angular-oauth2-oidc it's local storage).