How to read auth0 state parameter

shubham.goyal · February 3, 2021, 9:58pm

Hi,

I am looking for a way to read state parameter value on auth0 login page.

I am interested in state value that my app has passed while redirecting to /authorize?client_id=<client id>&state=<custom value>.

The state value we see on /login page is encoded. Is there a way to see whats inside that?

Thanks in advance.

stephanie.chamblee · February 4, 2021, 3:46pm

Hi @shubham.goyal,

The state parameter is a unique, unguessable string string that is base64 encoded. The state is used to prevent CSRF attacks. You can read more about state here: https://auth0.com/docs/protocols/state-parameters

This topic walks through how the state is used in auth0-spa-js package: Redirecting Users with State Parameters

shubham.goyal · February 4, 2021, 4:11pm

Thanks for replying… I understand the state concept and I have no issue with implementing it.

I am implementing a flow where I need to know user’s last location from where app initiated the login. this last location is passed by apps in state parameter while redicrecting to /authorize endpoint. this state values gets encoded and sent with /login endpoint. Now on this login page I need to know what was the original state value that app sent while redirecting to /authorize endpoint.

The purpose of this to achieve deep linking in registration flow. I want to retain the state so that I can redirect my user back to the page after email verification from where they started.

I asked another question with more detailed flow I am trying to acheive here but unfortunatly got no suggestion so far. How to read state that application sent to /authorize endpoint

I will really appritiate if you can show me some direction.

Thanks

stephanie.chamblee · February 4, 2021, 4:46pm

Ah okay! Are you following the flow described here?: Redirect Users from Within Rules

shubham.goyal · February 4, 2021, 4:58pm

I know about this as well… I think I have read almost every page of your documentation site

My problem is I need to retain the state for signup not login. signup involve verification hence we loose the original state. I need to retain that state with my verificaiton link so I can redirect my user properly…

think it like → I have to intitiate the same /authorize URL that user did intially but this time after verification.

lvillacin · July 13, 2021, 6:53pm

Any luck implementing this? Can’t seem to get a straight answer from docs or this forum how to actually dynamically redirect users using the state paremeter?

shubham.goyal · July 13, 2021, 7:03pm

If you want to redirect user after login based on state then its easy. just send whatever value you need at the time of calling authorize and you will get it back in your own format (the way you send it).

My case was little different. I wanted to read its value and save it for later use which is not possible for good reasons.

lvillacin · July 13, 2021, 7:07pm

Would you know how to access state after being redirected in auth0-react? If not, how does this work in a normal use case. Thank you very much!

shubham.goyal · July 13, 2021, 7:16pm

I believe for your case it would work like this

github.com

auth0/auth0-react/blob/master/examples/cra-react-router/src/index.tsx#L6


      
          import React, { PropsWithChildren } from 'react';
          import ReactDOM from 'react-dom';
          import App from './App';
          import { Auth0Provider, AppState } from '@auth0/auth0-react';
          import { BrowserRouter, useNavigate } from 'react-router-dom';
          import { Auth0ProviderOptions } from '../../../src';
          
          
const Auth0ProviderWithRedirectCallback = ({
            children,
            ...props
          }: PropsWithChildren<Auth0ProviderOptions>) => {
            const navigate = useNavigate();
          
          
  const onRedirectCallback = (appState?: AppState) => {
              navigate((appState && appState.returnTo) || window.location.pathname);
            };

vov.afamilkin · July 19, 2021, 5:42am

My problem is I need to retain the state for signup not login. signup involve verification hence we loose the original state. I need to retain that state with my verificaiton link so I can redirect my user properly.

mlapierre · September 15, 2022, 6:33pm

Any luck resolving this? We’re having the same issue with the reset (forgot) password flow, where initial parameters are not propagated in the email’s link.

Arsenalist · April 2, 2023, 6:36pm

Did anyone figure out how to read the state parameter in the callback - I’m using openid-express-connect and can’t seem to have access to what I pass in the state param.

miandrew · September 12, 2024, 4:17pm

To view the decoded state parameter, you’ll need to decode the base64-encoded value. You can use an online base64 decoder or decode it programmatically. However, keep in mind that Auth0 might encrypt the state value for security reasons, making it unreadable directly. If it’s encrypted, you won’t be able to decode it without the encryption key.