I'm getting dinged in the security review for passing my package namespace prefix back in the state parameter of the OAuth callback.
https://login.salesforce.com/services/oauth2/authorize?response_type=code&state=" + '{! namespacePrefix}' + "&client_id=myClientIdHere&redirect_uri=" + '{! URLENCODE(activeOauthCallback)}
I've already looked at questions like this (Determining Namespace Prefix in JavaScript and Apex) which explain how to determine the namespace, but that doesn't help me because I need to figure out how to pass the namespace back to my server during or immediately before or after my OAuth flow.
My integration needs this prefix information to be able to make OAuth'ed API calls back to a custom rest endpoint I defined in the package. How am I supposed to get the package namespace into my 3rd party platform?