I don't get it, you have to generate the session server side before redirect so you can do all your checks there, from rate limiting, etc.

pass a nonce or something that you can check for before creating the redirect to make sure it's being generated from your own site.