Invalid state (error 500) after PHP/SDK redirect

josh.cunningham · August 5, 2018, 2:35am

Your best bet is to look where that is verified and work backwards from there:

auth0/auth0-PHP/blob/main/src/Auth0.php#L447


      
          public function getIdToken(): ?string
          {
              return $this->getState()->getIdToken();
          }
          
          
public function getUser(): ?array
          {
              return $this->getState()->getUser();
          }
          
          
public function getAccessToken(): ?string
          {
              return $this->getState()->getAccessToken();
          }
          
          
public function getRefreshToken(): ?string
          {
              return $this->getState()->getRefreshToken();
          }
          
          
public function getAccessTokenScope(): ?array

I would assume the URL parameter is working fine so I would probably start with checking into how sessions are working in your environment, maybe add some additional logging to catch more information about the error.

Something that just came to mind … can you visit your callback URL directly? And, if so, does it throw that same error if you leave off the necessary code and state parameters? Would there be any way that someone could get there, maybe even a bot?

Topic		Replies	Views
Invalid state -> php error Help php	7	11202	December 1, 2018
"Invalid state" error during Auth0 WordPress redirect Help wordpress , redirect , state	19	15336	July 26, 2019
PHP SDK 8 - Invalid State After SignUp Redirect Help auth0-php	7	4464	March 31, 2022
Auth0 PHP SDK: Invalid state Help auth0 , callback , state	8	3358	January 30, 2024
Invalid state (composer/php) Help login-experience , new-universal-login-experience	9	1114	June 5, 2023

Invalid state (error 500) after PHP/SDK redirect

Related topics