Auth0 login State Parameter duration

[dawid.matuszczyk]

Hi @rene.heijdens

Welcome to the Auth0 Community!

Thank you for your question. The behavior you observe is expected, as the state parameter has a limited lifetime due to security reasons. Unfortunately, it’s not possible to modify the length or size format of the parameter.

Validate State Parameter

Last Updated: Dec 17, 2024 Overview This article explains whether it is possible to validate the value in the state parameter, for example, if the characters are alphanumeric. Applies To State Parameter Solution The values in the state parameter are an internal artifact within the Auth0 Authorization Server. Those should be handled as opaque values. Applying or checking any validation on those in terms of size, length, format, etc., is not supported

State Parameter Validation Length

Overview This article explains how much time it takes for the state parameter to expire. Auth0 documentation states that after some time, the state is no longer valid. Documentation notes per Users bookmark login page: “When an application initiates the login process, it navigates to https://Tenant Name/authorize with a set of required parameters. Auth0 then redirects end-users to an https://tenant/login page, with a URL that looks like: https://tenant/login?state=g6Fo2SBjNTRyanlVa3ZqeHN4d1h…

Thanks
Dawid