Custom Domain Universal Login - Sign Up Works, but Login Fails with "Invalid state" Error

Help
,
1

We’re facing an issue with our Auth0 Universal Login page using a custom domain (auth.example.com). While Sign-Up works seamlessly, Login consistently fails with the following error:

{
“statusCode”: 403,
“description”: “Invalid state”,
“name”: “AnomalyDetected”,
“code”: “access_denied”
}

Key Details:

Custom Domain: auth.example.com
Callback URL: https://my.example.com
Allowed Callback URLs, Logout URLs, and Web Origins:** Configured correctly
Sign-Up via Universal Login: Works without issues
“Try Now” button from Auth0 Dashboard: Login works perfectly

Observed Behavior:

When attempting login via our custom login implementation, the above error is triggered. However, using the Auth0 Dashboard’s “Try Now” button for the same flow, login succeeds without any errors.

Steps Taken:

  • Verified Allowed Callback URLs, Logout URLs, and Web Origins.
  • Ensured cookies are enabled in the browser.
  • Checked DNS configuration for the custom domain.
  • Cleared browser cache and cookies.
  • Compared settings between dashboard “Try Now” flow and our implementation.

Looking for assistance in identifying why this error occurs and how to resolve it. Any insights or suggestions would be greatly appreciated!

3

code for the login is similar to the one below.

window.addEventListener('load', function () {
  var config = {
    domain: 'auth.example.com',
    clientID: 'My_Client_ID',
    callbackURL: 'https://my.example.com'
  };

  var webAuth = new auth0.WebAuth({
    domain: config.domain,
    clientID: config.clientID,
    redirectUri: config.callbackURL,
    responseType: 'code',
    scope: 'openid profile email',
  });

  // Login functionality
  document.getElementById('btn-login').addEventListener('click', function () {
    var email = document.getElementById('email').value;
    var password = document.getElementById('password').value;

    webAuth.login({
      realm: 'Username-Password-Authentication',
      username: email,
      password: password,
    }, function (err) {
      if (err) {
        console.error(err);
      }
    });
  });
});
4

Hi @kasunwijerathnaiit,

Can you try using redirect_uri instead of redirectUri in the WebAuth method?

5

Hi @sumansaurav. i changed it like that and checked now. but got same error…

6

So, the ‘Invalid State’ error caused due to state parameter missing or not matching from initial value.

Here is few community post that could help you: