# How to validate the state parameter on the server in an Auth0.js Cross-Origin Authentication flow **URL:** \ **Category:** Get Help\ **Tags:** sdks-quickstarts, auth0js\ **Created:** [August 10, 2025, 10:20am UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405 "2025-08-10T10:20:38Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jraoult-appraised](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jraoult-appraised/32/8656_2.png) [@jraoult-appraised](https://community.auth0.com/u/jraoult-appraised)\ **Post date:** [August 10, 2025, 10:20am UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405/1 "2025-08-10T10:20:38Z")
Hi, We’ve implemented a custom sign-in form using _Auth0.js_ and have enabled a custom domain. We are using the [`webAuth.login()`](https://auth0.com/docs/libraries/auth0js#webauth-login-) method to initiate the [_Cross-Origin Authentication_](https://auth0.com/docs/authenticate/login/cross-origin-authentication) flow. We understand that _Auth0.js_ first calls the `/co/authenticate` endpoint to get a login ticket, then generates a `state` value, and finally redirects to the `/authorize` endpoint with this `state` value included in the query string. Upon a successful return from the `/authorize` endpoint, Auth0 redirects the user to our server’s `/callback` endpoint with the `state` parameter. The challenge is validating this `state` value on our server. Since _Auth0.js_ generates the `state` value client-side, how can our server-side callback implementation verify it? ---
**Author:** ![nancy865miler](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nancy865miler/32/74528_2.png) [@nancy865miler](https://community.auth0.com/u/nancy865miler)\ **Post date:** [August 12, 2025, 10:46am UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405/2 "2025-08-12T10:46:17Z")
The key here is that in Cross-Origin Authentication with Auth0.js, the state parameter is generated in the browser, so your server doesn’t automatically know what it should be checking against unless you’ve coordinated that value ahead of time. ---
**Author:** ![jraoult-appraised](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jraoult-appraised/32/8656_2.png) [@jraoult-appraised](https://community.auth0.com/u/jraoult-appraised)\ **Post date:** [August 12, 2025, 5:10pm UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405/3 "2025-08-12T17:10:25Z")
Indeed, I contacted support in the meantime and the conclusion is that we need to generate the _state_ server side and store it, (in a cookie for example) to be able to use it later in `/callback`, then communicate the value to the front end and use when calling _Auth0.js_’s `login` method. ---
**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Post date:** [August 12, 2025, 5:12pm UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405/4 "2025-08-12T17:12:44Z")
Hi @jraoult-appraised Welcome back to the Auth0 Community! As @nancy865miler has mentioned, unless the state is being generated on the server before redirection is performed, you don’t have any indicators to use in order to validate the state itself. Perhaps our documentation on [CSRF Attacks](https://auth0.com/docs/secure/attack-protection/state-parameters) and [user redirection](https://auth0.com/docs/authenticate/login/redirect-users-after-login) might help you understand the situation better. Of course, this would require a custom implementation for your application. If you have any other questions on the matter, let me know! Kind Regards, Nik ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [August 26, 2025, 5:12pm UTC](https://community.auth0.com/t/how-to-validate-the-state-parameter-on-the-server-in-an-auth0-js-cross-origin-authentication-flow/190405/5 "2025-08-26T17:12:47Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.