diff --git a/app/controllers/oauth_callback_controller.rb b/app/controllers/oauth_callback_controller.rb
index 75d818efa..c74b119f4 100644
--- a/app/controllers/oauth_callback_controller.rb
+++ b/app/controllers/oauth_callback_controller.rb
@@ -95,9 +95,12 @@ class OauthCallbackController < ApplicationController
   end
 
   def account_from_signed_id
-    raise 'Missing state variable' if params[:state].blank?
+    raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?
 
-    GlobalID::Locator.locate_signed(params[:state])
+    account = GlobalID::Locator.locate_signed(params[:state])
+    raise 'Invalid or expired state' if account.nil?
+
+    account
   end
 
   def account