Invalid state (error 500) after PHP/SDK redirect

josh.cunningham · August 5, 2018, 2:35am

Your best bet is to look where that is verified and work backwards from there:

auth0/auth0-PHP/blob/main/src/Auth0.php#L447


      
          public function getIdToken(): ?string
          {
              return $this->getState()->getIdToken();
          }
          
          
public function getUser(): ?array
          {
              return $this->getState()->getUser();
          }
          
          
public function getAccessToken(): ?string
          {
              return $this->getState()->getAccessToken();
          }
          
          
public function getRefreshToken(): ?string
          {
              return $this->getState()->getRefreshToken();
          }
          
          
public function getAccessTokenScope(): ?array

I would assume the URL parameter is working fine so I would probably start with checking into how sessions are working in your environment, maybe add some additional logging to catch more information about the error.

Something that just came to mind … can you visit your callback URL directly? And, if so, does it throw that same error if you leave off the necessary code and state parameters? Would there be any way that someone could get there, maybe even a bot?