How to read auth0 state parameter

Hi,

I am looking for a way to read state parameter value on auth0 login page.

I am interested in state value that my app has passed while redirecting to /authorize?client_id=<client id>&state=<custom value>.

The state value we see on /login page is encoded. Is there a way to see whats inside that?

Thanks in advance.

Hi @shubham.goyal,

The state parameter is a unique, unguessable string string that is base64 encoded. The state is used to prevent CSRF attacks. You can read more about state here: https://auth0.com/docs/protocols/state-parameters

This topic walks through how the state is used in auth0-spa-js package: Redirecting Users with State Parameters

Thanks for replying… I understand the state concept and I have no issue with implementing it.

I am implementing a flow where I need to know user’s last location from where app initiated the login. this last location is passed by apps in state parameter while redicrecting to /authorize endpoint. this state values gets encoded and sent with /login endpoint. Now on this login page I need to know what was the original state value that app sent while redirecting to /authorize endpoint.

The purpose of this to achieve deep linking in registration flow. I want to retain the state so that I can redirect my user back to the page after email verification from where they started.

I asked another question with more detailed flow I am trying to acheive here but unfortunatly got no suggestion so far. How to read state that application sent to /authorize endpoint

I will really appritiate if you can show me some direction.

Thanks

1 Like

Ah okay! Are you following the flow described here?: Redirect Users from Within Rules

I know about this as well… I think I have read almost every page of your documentation site :slight_smile:

My problem is I need to retain the state for signup not login. signup involve verification hence we loose the original state. I need to retain that state with my verificaiton link so I can redirect my user properly…

think it like → I have to intitiate the same /authorize URL that user did intially but this time after verification.

Any luck implementing this? Can’t seem to get a straight answer from docs or this forum how to actually dynamically redirect users using the state paremeter?

If you want to redirect user after login based on state then its easy. just send whatever value you need at the time of calling authorize and you will get it back in your own format (the way you send it).

My case was little different. I wanted to read its value and save it for later use which is not possible for good reasons.

Would you know how to access state after being redirected in auth0-react? If not, how does this work in a normal use case. Thank you very much!

I believe for your case it would work like this

My problem is I need to retain the state for signup not login. signup involve verification hence we loose the original state. I need to retain that state with my verificaiton link so I can redirect my user properly.

Any luck resolving this? We’re having the same issue with the reset (forgot) password flow, where initial parameters are not propagated in the email’s link.

Did anyone figure out how to read the state parameter in the callback - I’m using openid-express-connect and can’t seem to have access to what I pass in the state param.