# BadRequestError: state mismatch **URL:** \ **Category:** Get Help\ **Tags:** login, auth0\ **Created:** [March 29, 2022, 2:23am UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675 "2022-03-29T02:23:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![anil.kukreti](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anil.kukreti/32/35108_2.png) [@anil.kukreti](https://community.auth0.com/u/anil.kukreti)\ **Post date:** [March 29, 2022, 2:23am UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/1 "2022-03-29T02:23:00Z")
Hi Few days back my auth0 integration with node.js using express-openid-connect was working … but now it started giving error after the authentication done BadRequestError: state mismatch, expected eyJyZXR1cm5UbyI6Ii8ifQ, got: hKFo2SBOVEhFUHlkWnA0SzBWTDgyM1l3cHRkMnF5eHBpdTNGNqFupWxvZ2luo3RpZNkgVU4wRS1mWXdkbG80MDFIZzk4WHZ5bUtNcWhoc3drdXGjY2lk2SBqVlRPbDQ2T2NKVTR4d2pRdnBZMlNnNUxJNGZOZzN3NQ at /home/ubuntu/ProUserManagement/node\_modules/express-openid-connect/middleware/auth.js:121:19 at processTicksAndRejections (internal/process/task\_queues.js:95:5) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [March 30, 2022, 2:58pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/3 "2022-03-30T14:58:24Z")
Hi @anil.kukreti, Welcome to the Auth0 Community! Can you please provide details on the version of the modules you are using? ---
**Author:** ![anil.kukreti](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anil.kukreti/32/35108_2.png) [@anil.kukreti](https://community.auth0.com/u/anil.kukreti)\ **Post date:** [April 6, 2022, 5:05am UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/4 "2022-04-06T05:05:51Z")
Hi Dan Woda , Thanks a lot for taking time to reply on question. Further , I extend my sincere apologies for replying so late. I am using express-openid-connect 2.6.0 version. I noticed initially after the auth flow gets completed … I get bad state error (exception is thrown in logs) but if i refresh the page , I get success result and landup to right page . So for now I am just hiding error due to bad state , via express error handler and proceeding to the dashboard once authentication completes. But still bad error exception is there. Thanks ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [April 6, 2022, 4:09pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/5 "2022-04-06T16:09:18Z")
Have you tried the most recent version? Also, have you looked through this thread? [state mismatch error · Issue #170 · auth0/express-openid-connect · GitHub](https://github.com/auth0/express-openid-connect/issues/170) ---
**Author:** ![anil.kukreti](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anil.kukreti/32/35108_2.png) [@anil.kukreti](https://community.auth0.com/u/anil.kukreti)\ **Post date:** [April 12, 2022, 3:50am UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/6 "2022-04-12T03:50:40Z")
Yes I have tried the recent version , Its the same problem… ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [April 12, 2022, 3:32pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/7 "2022-04-12T15:32:26Z")
Can you please share the code you are using? I would like to try to reproduce the error. ---
**Author:** ![anil.kukreti](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anil.kukreti/32/35108_2.png) [@anil.kukreti](https://community.auth0.com/u/anil.kukreti)\ **Post date:** [April 12, 2022, 3:48pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/8 "2022-04-12T15:48:07Z")
Here it is ```auto app.use( auth({ issuerBaseURL: sharedLC.ISSUER_BASE_URL, baseURL: sharedLC.BASE_URL, clientID: sharedLC.CLIENT_ID, secret: sharedLC.CLIENT_SECRET, idpLogout: true, // authRequired: false, auth0Logout: true, }), ); // error handler app.use((err, req, res, next) => { console.error(err.stack) if (err.message.includes('state mismatch')) { res.redirect("https://webadmin.super2110.com"); } else { res.status(500).send('Something broke!' + err.message) } }) app.get('/', async (req, res) => { var body = req.body; console.log(req.oidc.user); }); ``` ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [April 12, 2022, 8:22pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/9 "2022-04-12T20:22:47Z")
Thanks for sharing. I don’t see any glaring issues here (although it appears you are using your client\_secret as the generic app secret, which is not recommended). I’m not seeing other reports of this issue, which leads me to believe this is isolated to your application. Is there any other info you can provide? What changed when you started seeing this error? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [May 25, 2022, 9:29pm UTC](https://community.auth0.com/t/badrequesterror-state-mismatch/80675/10 "2022-05-25T21:29:07Z")