diff --git a/addons/google_account/controllers/main.py b/addons/google_account/controllers/main.py
index 37d2234d056..243d686f22b 100644
--- a/addons/google_account/controllers/main.py
+++ b/addons/google_account/controllers/main.py
@@ -2,6 +2,7 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 import json
+from werkzeug.exceptions import BadRequest
 
 from odoo import http
 from odoo.http import request
@@ -12,9 +13,11 @@ class GoogleAuth(http.Controller):
     @http.route('/google_account/authentication', type='http', auth="public")
     def oauth2callback(self, **kw):
         """ This route/function is called by Google when user Accept/Refuse the consent of Google """
-        state = json.loads(kw['state'])
+        state = json.loads(kw.get('state', '{}'))
         service = state.get('s')
         url_return = state.get('f')
+        if (not service or (kw.get('code') and not url_return)):
+            raise BadRequest()
 
         if kw.get('code'):
             base_url = request.httprequest.url_root.strip('/') or request.env.user.get_base_url()