I want to add Google and facebook login button on my PHP website

Help
,
1

I have added the Facebook and Google login buttons with Auth0 SDK.

I am generating a login link by Auth0 SDK. When I click on the first generated link it throws an error called “In valid State”. Like if I generate first google link then getting an error in google login where facebook will work correctly. If I generate the facebook link first then getting an error in facebook login and google login is working proper.

My code like

<?PHP $auth0 = new Auth0([ 'domain' => $settings->setting['api']['auth0_domain'], 'clientId' => $settings->setting['api']['auth0_client_id'], 'clientSecret' => $settings->setting['api']['auth0_client_secret'], 'redirectUri' => $redirectUrl, 'cookieSecret' => AUTH0_COOKIE_SECRET ]); $fb_state = bin2hex(random_bytes(16)); // Generate a random string $fb_authorize_params = [ 'connection' => 'facebook', 'state' => $fb_state // Pass the generated state ]; $facebook_login_url = htmlspecialchars($auth0->login($redirectUrl, $fb_authorize_params)); $auth1 = new Auth0([ 'domain' => $settings->setting['api']['auth0_domain'], 'clientId' => $settings->setting['api']['auth0_client_id'], 'clientSecret' => $settings->setting['api']['auth0_client_secret'], 'redirectUri' => $redirectUrl, 'cookieSecret' => AUTH0_COOKIE_SECRET ]); $google_state = bin2hex(random_bytes(16)); // Generate a random string $google_authorize_params = [ 'connection' => 'google-oauth2', 'state' => $google_state // Pass the generated state ]; $google_login_url = htmlspecialchars($auth1->login($redirectUrl, $google_authorize_params)); ?>

<?= $session->t('login_with_facebook'); ?>
<?= $session->t('login_with_google'); ?>

2

Hi @ankit.makadiya,

An invalid state error occurs when the state value saved to the device’s cookie doesn’t match the state returned by Auth0.

  • In your case, you’re calling login() several times in succession, and each time, a new state value is being generated and saved to the device, overwriting the previous.
  • You don’t need to generate your own state values for these; the SDK does this for you.
  • You don’t need multiple instances of the Auth0 SDK class; you can do this with the same one.

You should only call login() immediately before redirecting the user through the authentication process. Storing the generated URLs in this manner won’t work.