Hey there @Auth0.user ,
Thank you for posting.
- The
stateURL parameter its just a value being created during the initial step of the authorization process (by the client app) to ensure the requests happen between the same IdP and a client app (the client app expects the state value received in a response from the IdP to be the same as it’s initially generated).
http://tenant.auth0.com/authorize?...&state=xyzABC123
How can I show a message to the user saying they have been blocked
This doc can put some light on it. Unfortunately, currently there is no way to adjust the flow. There is also some suggestion there for a workaround.
This topic refers to a similar problem.
The doc describes scenarios where Auth0 redirect to a default or custom error pages.
I hope it helps!