# Auth0 PHP SDK: Invalid state

**URL:** <https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200>\
**Category:** Get Help\
**Tags:** state, callback, auth0\
**Created:** [June 15, 2022, 10:53pm UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200 "2022-06-15T22:53:42Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![pitsnthings](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pitsnthings/32/38065_2.png) [@pitsnthings](https://community.auth0.com/u/pitsnthings)\
**Post date:** [June 15, 2022, 10:53pm UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/1 "2022-06-15T22:53:42Z")

</div>

I know this problem may have been discussed a lot in these forums but I can’t seem to find an answer that fixes this problem.  
I’m using the auth0 PHP SDK and am using a lot of the code from the quickstart guide for PHP.  
The problem is, when I attempt to login by pressing the sign in button on my page, I get taken to a blank page with an error in the console of my PHP develpment server. The error is as follows:

```auto
127.0.0.1:59994 [500]: GET /callback.php?code=jDjrZOQz-Ts7lKmG3CjYXTrGZA-XP0zPkFOl6-od4eWpW&state=fdf4f0369232d4e5a2a208e2058292f0 - Uncaught Auth0\SDK\Exception\StateException: Invalid state in /home/npatrick/Code/artichoke3d/vendor/auth0/auth0-php/src/Exception/StateException.php:24
Stack trace:
#0 /home/npatrick/Code/artichoke3d/vendor/auth0/auth0-php/src/Auth0.php(322): Auth0\SDK\Exception\StateException::invalidState()
#1 /home/npatrick/Code/artichoke3d/callback.php(15): Auth0\SDK\Auth0->exchange()
#2 {main}
  thrown in /home/npatrick/Code/artichoke3d/vendor/auth0/auth0-php/src/Exception/StateException.php on line 24

```

The result I was hoping for was to see my index.php page with a name and email showing in the place of the “sign in” button.  
here is my index.php:

```auto
    <?php
    $_SESSION["redirect_url"] = "http://127.0.0.1:3000";
    require 'vendor/autoload.php';
    (Dotenv\Dotenv::createImmutable( __DIR__ ))->load();
    $auth0 = new \Auth0\SDK\Auth0([
      'domain' => $_ENV['AUTH0_DOMAIN'],
      'clientId' => $_ENV['AUTH0_CLIENT_ID'],
      'clientSecret' => $_ENV['AUTH0_CLIENT_SECRET'],
      'cookieSecret' => $_ENV['AUTH0_COOKIE_SECRET']
    ]);
    if ($session === null) {
      $_SESSION['auth0__webauth_state'] = 123456;
      echo '<a class="loginButton" href="http://127.0.0.1:3000/login.php">Sign in</a>';
    } else {
      echo '<button onclick="myFunction()" class="dropbtn">' . $session->user["email"] . '</button><img class="profileImg" src="', $session->user["picture"] . '" height="32px" width="32px">';
    }

    ?>

```

login.php:

```auto
<?php
require 'vendor/autoload.php';

(Dotenv\Dotenv::createImmutable( __DIR__ ))->load();
define('ROUTE_URL_INDEX', "http://127.0.0.1:3000");
define('ROUTE_URL_LOGIN', ROUTE_URL_INDEX . '/login_redirect.php');
define('ROUTE_URL_CALLBACK', ROUTE_URL_INDEX . '/callback.php');
define('ROUTE_URL_LOGOUT', ROUTE_URL_INDEX . '/logout.php');
$auth0 = new \Auth0\SDK\Auth0([
  'domain' => $_ENV['AUTH0_DOMAIN'],
  'clientId' => $_ENV['AUTH0_CLIENT_ID'],
  'clientSecret' => $_ENV['AUTH0_CLIENT_SECRET'],
  'cookieSecret' => $_ENV['AUTH0_COOKIE_SECRET']
]);
$auth0->clear();
header("Location: " . $auth0->login("http://127.0.0.1:3000/callback.php"));
exit;
?>

```

callback.php

```auto
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
(Dotenv\Dotenv::createImmutable( __DIR__ ))->load();
define('ROUTE_URL_INDEX', "http://127.0.0.1:3000");
define('ROUTE_URL_LOGIN', ROUTE_URL_INDEX . '/login_redirect.php');
define('ROUTE_URL_CALLBACK', ROUTE_URL_INDEX . '/callback.php');
define('ROUTE_URL_LOGOUT', ROUTE_URL_INDEX . '/logout.php');
$auth0 = new \Auth0\SDK\Auth0([
  'domain' => $_ENV['AUTH0_DOMAIN'],
  'clientId' => $_ENV['AUTH0_CLIENT_ID'],
  'clientSecret' => $_ENV['AUTH0_CLIENT_SECRET'],
  'cookieSecret' => $_ENV['AUTH0_COOKIE_SECRET']
]);
$auth0->exchange(ROUTE_URL_CALLBACK);
header("Location: " . $_SESSION["redirect_url"]);
exit;
?>

```

logout.php:

```auto
<?php
require 'vendor/autoload.php';
(Dotenv\Dotenv::createImmutable( __DIR__ ))->load();
define('ROUTE_URL_INDEX', "http://127.0.0.1:3000");
define('ROUTE_URL_LOGIN', ROUTE_URL_INDEX . '/login_redirect.php');
define('ROUTE_URL_CALLBACK', ROUTE_URL_INDEX . '/callback.php');
define('ROUTE_URL_LOGOUT', ROUTE_URL_INDEX . '/logout.php');
$auth0 = new \Auth0\SDK\Auth0([
  'domain' => $_ENV['AUTH0_DOMAIN'],
  'clientId' => $_ENV['AUTH0_CLIENT_ID'],
  'clientSecret' => $_ENV['AUTH0_CLIENT_SECRET'],
  'cookieSecret' => $_ENV['AUTH0_COOKIE_SECRET']
]);
header("Location: " . $auth0->logout($_SESSION["redirect_url"]));
exit;
?>

```

If you notice massy or inconsistent parts of my code, that is because I’m using bits and pieces copied from the quickstart guide and I plan to clean it up after I get a basic login system working. Also, I’m pretty new to this Auth0 stuff so sorry if this is a really dumb question.

---

<div class="post-metadata">

**Author:** ![pitsnthings](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pitsnthings/32/38065_2.png) [@pitsnthings](https://community.auth0.com/u/pitsnthings)\
**Post date:** [June 16, 2022, 9:58am UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/3 "2022-06-16T09:58:58Z")

</div>

I posted a question, not an answer

---

<div class="post-metadata">

**Author:** ![pitsnthings](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pitsnthings/32/38065_2.png) [@pitsnthings](https://community.auth0.com/u/pitsnthings)\
**Post date:** [June 20, 2022, 6:46am UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/4 "2022-06-20T06:46:21Z")

</div>

Does anybody have any ideas?

---

<div class="post-metadata">

**Author:** ![aplein](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/aplein/32/20522_2.png) [@aplein](https://community.auth0.com/u/aplein)\
**Post date:** [July 1, 2022, 6:34pm UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/5 "2022-07-01T18:34:37Z")

</div>

Running into a similar issue. I’ll let you know if I find a solution.

---

<div class="post-metadata">

**Author:** ![yodude](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yodude/32/34006_2.png) [@yodude](https://community.auth0.com/u/yodude)\
**Post date:** [October 20, 2022, 10:41am UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/6 "2022-10-20T10:41:41Z")

</div>

Also running into this issue of intermittent invalid state exception. It makes for very bad UX.

Do the Auth0 staff have any ideas about this? Any workarounds?

---

<div class="post-metadata">

**Author:** ![yodude](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yodude/32/34006_2.png) [@yodude](https://community.auth0.com/u/yodude)\
**Post date:** [March 11, 2023, 12:08am UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/7 "2023-03-11T00:08:52Z")

</div>

For such a big enterprise company as Auth0, these forums reflect a lack of professionalism and technical knowledge on the part of the staff. They just give some BS answers that don’t address the problem and leave it up to users to solve their own problems and when they do, the staff just chimes in with “thank you!” Pathetic

---

<div class="post-metadata">

**Author:** ![akshayw.softdev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/akshayw.softdev/32/49411_2.png) [@akshayw.softdev](https://community.auth0.com/u/akshayw.softdev)\
**Post date:** [January 30, 2024, 3:25pm UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/8 "2024-01-30T15:25:07Z")

</div>

It look like they also don’t know how to handle this issue.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 30, 2024, 3:49pm UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/10 "2024-01-30T15:49:36Z")

</div>

Hey all,

If you’re seeing the invalid state error, it’s generally because the state param in the application does not match the state param returned by Auth0 after the authentication.

This is typically the result of 2 authentication transactions running back to back, which creates two state params and results in a “mismatch” between the param in the response and the one expected in the application.

There’s a good thread about it here:

> [@PHP SDK 8 - Invalid State After SignUp Redirect](https://community.auth0.com/t/php-sdk-8-invalid-state-after-signup-redirect/80550/2):
>
> Hi @paulrileydnrg wave An InvalidState exception is [thrown from the PHP SDK](https://github.com/auth0/auth0-PHP/blob/main/src/Auth0.php#L322) during exchange() when the state parameter returned by Auth0 doesn’t match the temporary cookie stored on the client when login() is fired before the redirect. This means there is either an issue with the cookie getting stored properly on the client before getting redirected, being retrieved from the client during callback, or an issue with pulling the state response from the callback request. Check your Auth0 logs …

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 14, 2024, 1:05am UTC](https://community.auth0.com/t/auth0-php-sdk-invalid-state/85200/11 "2024-11-14T01:05:23Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.