OAuthState contains data associated with a single oauth flow (currently just the url to redirect the user to after authentication completes).

Session contains data associated with a single user: who that user is and whether they're authenticated & authorized.