# Invalid State Error after Upgrading from Auth0 PHP SDK v7 to v8

**URL:** <https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435>\
**Category:** Get Help\
**Tags:** sdks-quickstarts, auth0-php\
**Created:** [July 22, 2024, 3:24pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435 "2024-07-22T15:24:34Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 22, 2024, 3:24pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/1 "2024-07-22T15:24:34Z")

</div>

```auto
Hello Auth0 team,

I've encountered an issue after upgrading the Auth0 PHP SDK from version 7 to version 8. The error occurred within a WHMCS environment. Below are the details of the error I'm experiencing:

**Error Message:**

```

[Mon Jul 22 14:53:57.433504 2024] [php:notice] [pid 1758830] [client 192.168.81.227:61846] [WHMCS Application] ERROR: Auth0\SDK\Exception\StateException: Invalid state in /var/www/html/whmcs/modules/addons/auth0/vendor/auth0/auth0-php/src/Exception/StateException.php:82 Stack trace: #0 /var/www/html/whmcs/modules/addons/auth0/vendor/auth0/auth0-php/src/Auth0.php(187): Auth0\SDK\Exception\StateException::invalidState() #1 /var/www/html/whmcs/sso.php(22): Auth0\SDK\Auth0-\>exchange() #2 {main} {“exception”:“[object] (Auth0\SDK\Exception\StateException(code: 0): Invalid state at /var/www/html/whmcs/modules/addons/auth0/vendor/auth0/auth0-php/src/Exception/StateException.php:82)”}

```auto
**Steps to Reproduce:**
1. Upgraded from Auth0 PHP SDK v7 to v8.
2. Encountered the error during the login process using Auth0's 'exchange' method in the WHMCS environment.

**Expected Behavior:**
The expected behavior was that the login process would complete without errors, as it did in the previous version of the SDK.

**Actual Behavior:**
An "Invalid State" error is thrown during the authentication flow, preventing the successful completion of the login process.

**Environment:**
- Auth0 PHP SDK Version: 8.x.x
- PHP Version: 8.x.x
- WHMCS Version: 8.x.x

Can you provide any guidance on what might be causing this issue and how to resolve it?

Thank you in advance for your help.

Best regards,
Reddy

```

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 22, 2024, 9:19pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/2 "2024-07-22T21:19:56Z")

</div>

Hi @yrmallu 👋 An invalid state error occurs when the state cookies generated and given to the end user’s device (when `login()` is called) do not match what is found during the return trip back after authenticating with Auth0.

This usually occurs because `login()` is inadvertently being called multiple times in the host application. Can you check if that is the case on your end?

P.S. I have a v7 → v8 migration guide you might find useful as well, if you haven’t come across it before; [auth0-PHP/UPGRADE.md at main · auth0/auth0-PHP · GitHub](https://github.com/auth0/auth0-PHP/blob/main/UPGRADE.md)

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 10:30am UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/3 "2024-07-23T10:30:42Z")

</div>

Hi @evansims ✋ Thanks for prompt response. Here is my code and didn’t have multiple login().

SSO working fine with Auth0 version 7.x but not with Auth0 version 8.x

`$auth0->getUser()` is giving invalid state error. Are there any changes on this method?

It was working fine with Auth0 version 7.x .

The following code snippet

```auto
<?php

session_start();

require( __DIR__. '/init.php');
require_once("modules/addons/auth0/auth0.php");
use Auth0\SDK\Exception\StateException;
use Auth0\SDK\Utility\PKCE;
use Latte\Engine as Template;

global $auth0;

if (isset($_GET['code'])) {

    $userInfo = $auth0->getUser();

    if (!$userInfo) {
        die('Error retrieving user info from Auth0.');
    }

    // Search for the user in WHMCS
    $result = localAPI('GetClients', ['search' => $userInfo['email']]);

    if ($result['totalresults'] <= 0) {
        // User doesn't exist in WHMCS, create a new one
        $createClientParams = [
            'firstname' => $userInfo['name'],
            'lastname' => $userInfo['name'],
            'email' => $userInfo['email'],
        ];
        $result = localAPI('AddClient', $createClientParams);

        if ($result['result'] !== 'success') {
            die('Error creating WHMCS client: ' . $result['message']);
        }

        $clientId = $result['clientid'];
   } else {
        $clientId = $result['clients']['client'][0]['id'];
    }

    $ssoResult = localAPI('CreateSsoToken', ['client_id' => $clientId]);

    if ($ssoResult['result'] !== 'success') {
        die('Error creating SSO token: ' . $ssoResult['message']);
    }

   // Redirect the user to WHMCS with the SSO token
   $redirectUrl = $ssoResult['redirect_url'];
   header('Location: ' . $redirectUrl);
   exit;
}

if (null === $session) {
    header("Location: " . $auth0->login());
    exit;
}

if ($session->accessTokenExpired === true) {
    $auth0->renew();
    $session = $auth0->getCredentials();
}

```

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 1:38pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/4 "2024-07-23T13:38:45Z")

</div>

Hi @yrmallu 👋

Ah, it looks like you might just be missing the `exchange()` step. This was introduced as part of v8 — you’ll need to do that before `getUser()` will work.

You can find some example usage in the README: [GitHub - auth0/auth0-PHP: PHP SDK for Auth0 Authentication and Management APIs.](https://github.com/auth0/auth0-php?tab=readme-ov-file#add-login-to-your-application)

Swap out:

```php
global $auth0;

if (isset($_GET['code'])) {

    $userInfo = $auth0->getUser();
    // ...

```

with

```php
global $auth0;

if (null !== $auth0->getExchangeParameters()) {
    $auth0->exchange();
    $userInfo = $auth0->getUser();
    // ...

```

And see if that works for you.

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 3:37pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/5 "2024-07-23T15:37:50Z")

</div>

Hi @evansims,

Thanks for the response.

Currently I’m not getting code and login() function is not redirecting to callback url. Here is the code snippet

```auto
<?php

session_start(); 

require( __DIR__. '/init.php');
require_once("modules/addons/auth0/auth0.php");

global $auth0;

if (!isset($_GET['code'])) {
    try {
        $auth0->login();
    } catch (\Exception $e) {
        error_log('Login error: '.$e->getMessage());
        exit;
    }
} else {
    try {
        $auth0->exchange();
        $credentials = $auth0->getCredentials();
        // Rest of your WHMCS code here...
    } catch (\Exception $e) {
        error_log('Exchange error: '.$e->getMessage());
    }
}

```

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 3:49pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/6 "2024-07-23T15:49:49Z")

</div>

Hi @yrmallu 👋

`login()` returns the URL your application should redirect to but does not issue the redirect itself. This permits your application to perform any last-minute hygiene before you actually redirect the user.

Your original code had the correct sentiment on sending the `Location` header itself.

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 3:59pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/7 "2024-07-23T15:59:00Z")

</div>

Hi @evansims,

Thanks for the quick reply.

Sorry I didn’t get. What was the wrong with code?

It’s not redirecting to Auth0 portal for asking login details and appending code to the url.

Thanks

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 4:10pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/8 "2024-07-23T16:10:54Z")

</div>

No worries, this is what I’m referring to:

```php
    try {
        $auth0->login();
    } catch (\Exception $e) {

```

That `login()` call should instead read:

```php
    try {
        Header('Location: ' . $auth0->login());
        exit;
    } catch (\Exception $e) {

```

So that the user is redirected for the authentication flow. They’ll be returned to your app and that point the callback parameters will be present

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 4:11pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/9 "2024-07-23T16:11:39Z")

</div>

Hi @evansims,

Now redirecting is working fine and able to login into Auth0 but after login  
I’m getting

```auto
[Tue Jul 23 16:09:20.369259 2024] [php:notice] [pid 1802352] [client 192.168.81.227:63909] Exchange error: Invalid state
type or paste code here

```

Here the code

```auto
<?php

session_start(); // Make sure this is the first thing in your script.

require( __DIR__. '/init.php');
require_once("modules/addons/auth0/auth0.php");

global $auth0;

if (!isset($_GET['code'])) {
    try {
    try {
        // get intended login Url
        $loginUrl = $auth0->login();

        // redirect the user to the login Url
        header('Location: ' . $loginUrl);
        exit;
    } catch (\Exception $e) {
        error_log('Login error: '.$e->getMessage());
    }

} else {
    try {
        $auth0->exchange();
        $credentials = $auth0->getCredentials();
        // Rest of your WHMCS code here...
    } catch (\Exception $e) {
        error_log('Exchange error: '.$e->getMessage());
    }
}

```

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 4:13pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/10 "2024-07-23T16:13:00Z")

</div>

Before diving in further, can you confirm you don’t have any old cookies hanging around from previous attempts? That could be contributing to an invalid state error.

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 4:16pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/11 "2024-07-23T16:16:13Z")

</div>

Hi @evansims,

I have cleared all cache and cookies on Brower but still getting the same error

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 5:11pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/12 "2024-07-23T17:11:11Z")

</div>

Hi @evansims,

Just to let you know, I’m sharing the debugging state information

```auto
[Tue Jul 23 17:08:31.370121 2024] [php:notice] [pid 1802895] [client 192.168.81.227:50078] Generated State: 2fc15f86f6fc08bf976a473b314fbcdd
[Tue Jul 23 17:08:45.449470 2024] [php:notice] [pid 1802892] [client 192.168.81.227:50086] State returned from Auth0: 2fc15f86f6fc08bf976a473b314fbcdd

```

But still getting the same error

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 5:19pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/13 "2024-07-23T17:19:03Z")

</div>

Hmm, bizarre. An Invalid State can only be thrown if those two values don’t match, so something is off somewhere.

- Could you share how you’re initializing the Auth0 class? Minus any sensitive data, of course. 😄
- Could you elaborate on the specific SDK and PHP versions you are using in your environment and confirm that you have the OpenSSL extension enabled for PHP?

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 5:25pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/14 "2024-07-23T17:25:32Z")

</div>

@evansims Sure. Here the required information.

initializing the Auth0 class

```auto
$configuration = new SdkConfiguration(
    domain: $domain,
    clientId: $client_id,
    clientSecret: $client_secret,
    cookieSecret: $secret,
    cookieExpires: 3600,
    redirectUri: $redirect_uri
);

$auth0 = new Auth0($configuration);

```

PHP Version

```auto
PHP 8.1.2-1ubuntu2.18 (cli) (built: Jun 14 2024 15:52:55) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.2, Copyright (c) Zend Technologies
    with the ionCube PHP Loader v13.0.2, Copyright (c) 2002-2023, by ionCube Ltd.
    with Zend OPcache v8.1.2-1ubuntu2.18, Copyright (c), by Zend Technologies

```

And also OpenSSL extension enabled for PHP.

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 5:43pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/15 "2024-07-23T17:43:23Z")

</div>

Hi @yrmallu

Thanks for those additional details. Things look OK there.

Could you please run the following from your project’s root directory and share the resulting output here?

```bash
composer show

```

I’m wondering if that `session_start()` call is potentially messing with the cookie writing. I’d recommend removing that unless it’s absolutely necessary. Otherwise, you might need to use the `SessionStore` for session and transient storage with the SDK, as opposed to the default `CookieStore`.

```php
<?php
use Auth0\SDK\Auth0;
use Auth0\SDK\Configuration\SdkConfiguration;
use Auth0\SDK\Store\SessionStore;

$configuration = new SdkConfiguration(
    domain: $domain,
    clientId: $client_id,
    clientSecret: $client_secret,
    cookieSecret: $secret,
);

$sessionStorage = new SessionStore($configuration, $configuration->getSessionStorageId());
$transientStorage = new SessionStore($configuration, $this->getTransientStorageId());

$configuration->setSessionStorage($sessionStorage);
$configuration->setTransientStorage($transientStorage);

$auth0 = new Auth0($configuration);

```

(`SessionStore` internally sets up the session using `session_start()` on it’s own, so you won’t need to make that call yourself if you use it, unless you need session access prior to initializing the SDK.)

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 5:47pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/16 "2024-07-23T17:47:19Z")

</div>

@evansims Here is the

> composer show

results

```auto
auth0/auth0-php 8.11.1 PHP SDK for Auth0 Authentication and Management APIs.
composer/semver 3.4.2 Semver library that offers utilities, version constraint pars...
nyholm/psr7 1.8.1 A fast PHP7 implementation of PSR-7
php-http/discovery 1.19.4 Finds and installs PSR-7, PSR-17, PSR-18 and HTTPlug implemen...
php-http/multipart-stream-builder 1.3.1 A builder class that help you create a multipart stream
psr-discovery/all 1.0.1 Lightweight library that discovers available PSR implementati...
psr-discovery/cache-implementations 1.1.1 Lightweight library that discovers available PSR-6 Cache impl...
psr-discovery/container-implementations 1.1.1 Lightweight library that discovers available PSR-11 Container...
psr-discovery/discovery 1.1.1 Lightweight library that discovers available PSR implementati...
psr-discovery/event-dispatcher-implementations 1.1.1 Lightweight library that discovers available PSR-14 Event Dis...
psr-discovery/http-client-implementations 1.2.0 Lightweight library that discovers available PSR-18 HTTP Clie...
psr-discovery/http-factory-implementations 1.1.1 Lightweight library that discovers available PSR-17 HTTP Fact...
psr-discovery/log-implementations 1.0.1 Lightweight library that discovers available PSR-3 Log implem...
psr/cache 3.0.0 Common interface for caching libraries
psr/container 2.0.2 Common Container Interface (PHP FIG PSR-11)
psr/event-dispatcher 1.0.0 Standard interfaces for event handling.
psr/http-client 1.0.3 Common interface for HTTP clients
psr/http-factory 1.1.0 PSR-17: Common interfaces for PSR-7 HTTP message factories
psr/http-message 2.0 Common interface for HTTP messages
psr/log 3.0.0 Common interface for logging libraries

```

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 5:54pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/17 "2024-07-23T17:54:52Z")

</div>

@evansims Thanks for your suggestion.

I have removed _session\_start()_ and added suggested _SessionStore_ code.  
Now I’m getting new error

```auto
[Tue Jul 23 17:52:23.946676 2024] [php:error] [pid 1802892] [client 192.168.81.227:55173] PHP Fatal error: Declaration of GuzzleHttp\\Psr7\\Request::getRequestTarget() must be compatible with Psr\\Http\\Message\\RequestInterface::getRequestTarget(): string in /var/www/html/whmcs/vendor/guzzlehttp/psr7/src/Request.php on line 58
[Tue Jul 23 17:52:23.963816 2024] [php:notice] [pid 1802892] [client 192.168.81.227:55173] [WHMCS Application] ERROR: Whoops\\Exception\\ErrorException: Declaration of GuzzleHttp\\Psr7\\Request::getRequestTarget() must be compatible with Psr\\Http\\Message\\RequestInterface::getRequestTarget(): string in /var/www/html/whmcs/vendor/guzzlehttp/psr7/src/Request.php:58 Stack trace: #0 /var/www/html/whmcs/vendor/whmcs/whmcs-foundation/lib/Utility/Error/Run.php(0): WHMCS\\Utility\\Error\\Run->handleError() #1 [internal function]: WHMCS\\Utility\\Error\\Run->handleShutdown() #2 {main} {"exception":"[object] (Whoops\\\\Exception\\\\ErrorException(code: 64): Declaration of GuzzleHttp\\\\Psr7\\\\Request::getRequestTarget() must be compatible with Psr\\\\Http\\\\Message\\\\RequestInterface::getRequestTarget(): string at /var/www/html/whmcs/vendor/guzzlehttp/psr7/src/Request.php:58)"} []

```

---

<div class="post-metadata">

**Author:** ![evansims](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/evansims/32/27011_2.png) [@evansims](https://community.auth0.com/u/evansims)\
**Post date:** [July 23, 2024, 6:35pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/18 "2024-07-23T18:35:44Z")

</div>

Hi @yrmallu

Thanks for the additional detail. Interesting, I’m not sure what would be importing Guzzle from your `composer show` output there. We don’t import that on the SDK side.

In any case, it sounds like there might be an old version of the Guzzle dependency floating around somewhere in your project that isn’t compatible with the latest HTTP PSRs.

Can you try deleting your `composer.lock` file and `vendor` subdirectory and run `composer install` to fetch a fresh dependency tree?

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 6:39pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/19 "2024-07-23T18:39:18Z")

</div>

Hi @evansims,  
Guzzle came along with composer install. Is there any way to exclude?

Thanks

---

<div class="post-metadata">

**Author:** ![yrmallu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yrmallu/32/58746_2.png) [@yrmallu](https://community.auth0.com/u/yrmallu)\
**Post date:** [July 23, 2024, 6:43pm UTC](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435/20 "2024-07-23T18:43:55Z")

</div>

I removed composer.lock and vendor and installed composer freshly but still getting the same error.

The error is coming on `$auth0->exchange()`

[Next page](https://community.auth0.com/t/invalid-state-error-after-upgrading-from-auth0-php-sdk-v7-to-v8/139435.md?page=2)