# Authentication fails (AnomalyDetected, Invalid State) after multiple tabs logout, login in old tab

**URL:** <https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793>\
**Category:** Get Help\
**Created:** [March 3, 2021, 6:59am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793 "2021-03-03T06:59:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jev/32/26230_2.png) [@jev](https://community.auth0.com/u/jev)\
**Post date:** [March 3, 2021, 6:59am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/1 "2021-03-03T06:59:31Z")

</div>

We have encountered a strange behavior when our users uses multiple tabs (SPA). Simple steps how the issue is reproducible:

1. Open app and login using Auth0 universal login
2. Inside the page navigate somewhere but by opening new tab
3. Logout from the 1st tab, tab is redirected back to app login which again is redirected to Auth0 universal login
4. Logout from the 2nd tab (same redirects in place as in prev. step)
5. Try login in the 1st tab. Failure received with the following error:  
{“statusCode”:403,“description”:“Invalid state”,“name”:“AnomalyDetected”,“code”:“access\_denied”}

No Anomaly checks enabled. Looks like at step 4) logout in the 2nd tab does something with the state that interfere with the 1st tab flow. Is that an expected behavior? We use auth0-spa-js in our React app. Any ideas?

Thank you!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [March 3, 2021, 8:01pm UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/3 "2021-03-03T20:01:56Z")

</div>

Hi @jev,

Welcome to the Community! 🙂

I’m having difficulty recreating the behavior using the [Auth0 React SDK Quickstarts: Login](https://auth0.com/docs/quickstart/spa/react/01-login). Would you mind sharing the options you are passing to the `Auth0Provider` (be sure to take out any sensitive data such as domain or client ID)?

For example:

```auto
  <Auth0Provider
    domain={config.domain}
    clientId={config.clientId}
    audience={config.audience}
    scope="openid profile email"
    redirectUri={window.location.origin}
    cacheLocation="localstorage"
    onRedirectCallback={onRedirectCallback}
    useRefreshTokens={true}
  >
    <App />
  </Auth0Provider>,

```

---

<div class="post-metadata">

**Author:** ![jev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jev/32/26230_2.png) [@jev](https://community.auth0.com/u/jev)\
**Post date:** [March 4, 2021, 6:55am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/4 "2021-03-04T06:55:35Z")

</div>

Hi,

Thanks for such a fast response. We use approach described here:

> **[@auth0/auth0-spa-js](https://auth0.github.io/auth0-spa-js/)**
>
> Documentation for @auth0/auth0-spa-js

When we create client we use following parameters:

```
const auth0 = createAuth0Client({
  client_id: AUTH0_CLIENT_ID,
  domain: AUTH0_DOMAIN,
  redirect_uri: AUTH0_REDIRECT_URI,
  audience: AUTH0_AUDIENCE,
});

```

When we logout we just call:  
`auth0Client.logout({ returnTo: AUTH0_REDIRECT_URI });`

AUTH0\_REDIRECT\_URI points to main page in our app and is whitelisted in the dashboard.

Thanks!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [March 8, 2021, 2:51pm UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/5 "2021-03-08T14:51:52Z")

</div>

Hi @jev,

Does passing `cacheLocation: "localstorage"` correct the behavior?:

```auto
const auth0 = createAuth0Client({
  client_id: AUTH0_CLIENT_ID,
  domain: AUTH0_DOMAIN,
  redirect_uri: AUTH0_REDIRECT_URI,
  audience: AUTH0_AUDIENCE,
 cacheLocation='localstorage'
});

```

I’m wondering if this is caused by the auth data being stored in memory.

---

<div class="post-metadata">

**Author:** ![jev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jev/32/26230_2.png) [@jev](https://community.auth0.com/u/jev)\
**Post date:** [March 23, 2021, 9:06am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/6 "2021-03-23T09:06:46Z")

</div>

Apologies for the late reply… Thank you, that works. But this solution is not desirable as we have a requirement to store in memory. Is this something in the lib itself? Can we somehow workaround this one? Thank you!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [March 23, 2021, 11:15am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/7 "2021-03-23T11:15:13Z")

</div>

> [@jev](#):
>
> Can we somehow workaround this one?

Unfortunately, I don’t believe so because of the nature of memory storage. It doesn’t persist page refreshes and does not pick up changes in other tabs.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 7, 2021, 11:15am UTC](https://community.auth0.com/t/authentication-fails-anomalydetected-invalid-state-after-multiple-tabs-logout-login-in-old-tab/58793/8 "2021-04-07T11:15:31Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.