# Invalid state error when using /authorize endpoint directly in conjunction with the Auth0 SPA SDK **URL:** \ **Category:** Get Help\ **Tags:** new-universal-login-experience, login-experience\ **Created:** [April 21, 2023, 11:31am UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239 "2023-04-21T11:31:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mahmut.surekci](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mahmut.surekci](https://community.auth0.com/u/mahmut.surekci)\ **Post date:** [April 21, 2023, 11:31am UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239/1 "2023-04-21T11:31:54Z")
Hi, I’m making a request to the /authorize endpoint which is redirecting me to the login page where I enter my credentials and login. I am then redirected to redirect\_uri provided with the state value I had initially set when making the /authorize endpoint request. However, an `Invalid state` error is thrown. The redirect\_uri endpoint is using the Auth0 SPA SDK. It looks like the an item is set in sessionStorage but, the state value that is set in there does not match the state value I sent/received in the query parameters. Is it possible to call the /authorize endpoint directly and have the Auth0 SPA SDK recognize the state I had initially set in the /authorize request? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [April 21, 2023, 7:42pm UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239/3 "2023-04-21T19:42:01Z")
Hi @mahmut.surekci, Welcome to the Auth0 Community! I understand you have experienced an Invalid State Error when calling the `/authorize` endpoint. This error can happen when the `state` parameter gets lost during the authentication flow. When the first request is made to Auth0’s `/authorize` endpoint, a `state` parameter is passed to Auth0. When Auth0 returns to the application’s `/callback` endpoint with a code, it will supply the same `state` value. If SDK in the app loses the `state` that was originally sent to the `/authorize` endpoint, then an Invalid state error is thrown. > [@mahmut.surekci](#): > > Is it possible to call the /authorize endpoint directly and have the Auth0 SPA SDK recognize the state I had initially set in the /authorize request? Yes, AFAIK, this should be possible. To look into this issue further, could you please [capture the login events in a HAR file](https://auth0.com/docs/troubleshoot/troubleshooting-tools/generate-and-analyze-har-files) and send them to me as a direct message? Thank you, Rueben ---
**Author:** ![mahmut.surekci](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mahmut.surekci](https://community.auth0.com/u/mahmut.surekci)\ **Post date:** [May 9, 2023, 10:19am UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239/4 "2023-05-09T10:19:52Z")
Hi Rueben, I’ve sent you a message in private but, I’ve not received a response yet. I’d appreciate it if you could get back to me. Thanks, Mahmut ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [May 26, 2023, 7:21pm UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239/5 "2023-05-26T19:21:15Z")
Hi @mahmut.surekci, Thank you for your reply. After resolving the issue with you via direct messages, I am sharing the solution here to help the rest of the Community. Having investigated the HAR file carefully, I could not find any errors or issues with authentication. Both the `/authorize` request and the callback URL seem to be functioning without any problems. The HAR file clearly shows that an initial request was made to the `/authorize` endpoint. Subsequently, the login transaction was successful and the user was redirected back to the callback URL, also without any issues. Moreover, I have verified that the `state` parameter passed to the `/authorize` endpoint matches the one returned in the callback URL. Therefore, I can confirm that the `state` values are consistent. In my research, I found that the allowed length for the state parameter value is not unlimited. Hence, using a three-character string for the state, as observed in your HAR file, should not cause any problems. (Reference: [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters#:~:text=The%20allowed%20length%20for%20state%20parameter%20value%20is%20not%20unlimited.%20If%20you%20get%20the%20error%20414%20Request%2DURI%20Too%20Large%2C%20try%20a%20smaller%20value.)) In this case, I recommend logging in using the `loginWithRedirect()` method. This should generate the `state` parameter on your behalf and guarantees that it does not lose context throughout the transaction. Thanks, Rueben ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [June 9, 2023, 7:21pm UTC](https://community.auth0.com/t/invalid-state-error-when-using-authorize-endpoint-directly-in-conjunction-with-the-auth0-spa-sdk/105239/6 "2023-06-09T19:21:29Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.