# How do I avoid a0.invalid\_state

**URL:** <https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130>\
**Category:** Get Help\
**Tags:** login, auth0\
**Created:** [June 6, 2018, 12:54am UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130 "2018-06-06T00:54:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jackiegleason](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jackiegleason/32/8119_2.png) [@jackiegleason](https://community.auth0.com/u/jackiegleason)\
**Post date:** [June 6, 2018, 12:54am UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/1 "2018-06-06T00:54:50Z")

</div>

I am trying to get the login callback working. Currently it looks like this…

```
@GetMapping("/callback")
protected void getCallback(
        final HttpServletRequest req,
        final HttpServletResponse res
) throws IOException {
    service.handleCallback(req, res);
}
...
public void handleCallback(HttpServletRequest req, HttpServletResponse res) throws IOException {
    try {
        Tokens tokens = controller.handle(req); // breaks here
        TokenAuthentication tokenAuth = new TokenAuthentication(JWT.decode(tokens.getIdToken()));
        SecurityContextHolder.getContext().setAuthentication(tokenAuth);
        System.out.println("Questioning Reality Because it is redirecting correctly");
        res.sendRedirect(redirectOnSuccess);
    } catch (AuthenticationException | IdentityVerificationException e) {
        System.out.println("We are where I thought we would be");
        e.printStackTrace();
        SecurityContextHolder.clearContext();
        res.sendRedirect(redirectOnFail);
    }
}

```

But when it gets to the point where it breaks it says the state is invalid. If I check my Auth0 logs I see a successful login. What am I missing? I am using mod\_proxy if that could be doing something.

The error I get is…

```
com.auth0.InvalidRequestException: The request contains an error: a0.invalid_state
	at com.auth0.RequestProcessor.assertValidState(RequestProcessor.java:181)
	at com.auth0.RequestProcessor.process(RequestProcessor.java:103)
	at com.auth0.AuthenticationController.handle(AuthenticationController.java:141)

```

---

<div class="post-metadata">

**Author:** ![jackiegleason](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jackiegleason/32/8119_2.png) [@jackiegleason](https://community.auth0.com/u/jackiegleason)\
**Post date:** [June 6, 2018, 1:11am UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/2 "2018-06-06T01:11:35Z")

</div>

I can run it locally and it works. When that happens at this line…

```
return getSession(req).getAttribute(name);

```

I debug and run

```
getSession(req).getAttributeNames().hasMoreElements()

```

On the local I see true, but on the remote instance I see false. Could it be that the mod\_proxy is causing the session info to be lost?

---

<div class="post-metadata">

**Author:** ![eng.Adam](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@eng.Adam](https://community.auth0.com/u/eng.Adam)\
**Post date:** [June 21, 2018, 7:48am UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/3 "2018-06-21T07:48:13Z")

</div>

Hey ,

Did you find out a solution for this ? am having the same issue when I redirect the callback to localhost ?

---

<div class="post-metadata">

**Author:** ![dinmat](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dinmat/32/14057_2.png) [@dinmat](https://community.auth0.com/u/dinmat)\
**Post date:** [July 26, 2018, 5:36pm UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/4 "2018-07-26T17:36:11Z")

</div>

Hi,

Did you manage to fix this issue, if yes could you please post the solution.

---

<div class="post-metadata">

**Author:** ![awbranch](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@awbranch](https://community.auth0.com/u/awbranch)\
**Post date:** [August 23, 2018, 8:22pm UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/5 "2018-08-23T20:22:06Z")

</div>

I ran into a similar issue. Digging into the source I saw that the root problem was failing in com.auth0.RequestProcessor.assertValidState. The problem was that the Auth0 [state variable](https://auth0.com/docs/protocols/oauth2/oauth-state) was set in the request but not in the session. I’m using the v11 of the [embedded locket widget](https://auth0.com/docs/libraries/lock/v11), and during the upgraded from v10 to v11 it looks like the lock widget will set the the state variable to a nunce if you don’t specify it.

My solution was to set the state myself in the [Lock config](https://auth0.com/docs/libraries/lock/v11/configuration#params-object-) to a nunce I generated myself and then also make sure it got set in the session when the lock page is initially served.

Hope that helps

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 26, 2019, 9:24am UTC](https://community.auth0.com/t/how-do-i-avoid-a0-invalid-state/12130/6 "2019-07-26T09:24:52Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.