Hi,
we have the unfortunate case of some customers being unable to login from mobile (iOS, swift Auth0 SDK). It seems to be limited to some users/iPhones/iOS version combinations, but we are still investigating.
We’ve traced the problem to receiving this answer:
{
"statusCode": 403,
"description": "Invalid state",
"name": "AnomalyDetected",
"code": "access_denied"
}
From this authentication API endpoint:
https://.eu.auth0.com/usernamepassword/login
While this is reported from Anomaly Detection feature, it is not really a problem with blocked user or IP. In all “normal” anomaly detections cases, a specific error is reported and/or the user appears as blocked. This is not the case, also the user can login from Web.
We’ve not been able to receive any help from the SDK community on github and are investigating the possible cases for the server returning this unexpected error, in particular “Invalid state” description is not documented anywhere.
Is it somehow related to the “state” parameter in the REST request? If so, can you please detail the expected flow of this value in Auth0’s server? We know that it can be any random value on the client side and should be checked on the client at the end of the client flow part, but here is Auth0’s server returning an error, so it somehow makes some internal checks on the value and it fails. Any details on this could help us solve the problems.
Thanks!