Auth0 PHP SDK: Invalid state

[dan.woda]

Hey all,

If you’re seeing the invalid state error, it’s generally because the state param in the application does not match the state param returned by Auth0 after the authentication.

This is typically the result of 2 authentication transactions running back to back, which creates two state params and results in a “mismatch” between the param in the response and the one expected in the application.

There’s a good thread about it here:

PHP SDK 8 - Invalid State After SignUp Redirect

Hi @paulrileydnrg An InvalidState exception is thrown from the PHP SDK during exchange() when the state parameter returned by Auth0 doesn’t match the temporary cookie stored on the client when login() is fired before the redirect. This means there is either an issue with the cookie getting stored properly on the client before getting redirected, being retrieved from the client during callback, or an issue with pulling the state response from the callback request. Check your Auth0 logs …