# \[SOLVED\] Android: mismatching\_state: CSRF Warning! State not equal in request and response **URL:** \ **Category:** Get Help\ **Tags:** login-experience, new-universal-login-experience\ **Created:** [January 12, 2025, 1:05pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365 "2025-01-12T13:05:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![betterautomations1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/betterautomations1/32/60209_2.png) [@betterautomations1](https://community.auth0.com/u/betterautomations1)\ **Post date:** [January 12, 2025, 1:05pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365/1 "2025-01-12T13:05:24Z")
I only have this problem in Android; Windows and iOS are fine. My app ([app.securecoop.com](https://app.securecoop.com/)) runs on Django+Gunicorn+Nginx. Nginx communicates via UNIX socket to Gunicorn, so there is no way to use the Django setting `CSRF_TRUSTED_ORIGINS`. I used [this tutorial](https://developer.auth0.com/resources/guides/web-app/django/basic-authentication) to build the Django app. Not knowing much about authentication, I didn’t change much from the original login/logout code. That tutorial uses the Auth0 new universal login. I use a custom subdomain for logging in. After I login with Android, /callback ([here is the full URL, but code and state are partially obscured](https://app.securecoop.com/callback?code=62dKZgXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&state=BOumbp1XXXXXXXXXXXXXXXXXXXXX)) is supposed to redirect to /home, and it does on Windows and iOS, but on Android it throws the following error. Please note that login is successful; If I go back to the home page it shows logged in. It’s just throwing an error on redirect. ![image](https://global.discourse-cdn.com/auth0/original/3X/8/a/8afb60ed3616754d14a2d42d0f80e6fd45e47fca.png) I have exhausted the other hits on this forum such as [this post](https://community.auth0.com/t/mismatching-state-csrf-warning-state-not-equal-in-request-and-response/152775) (I didn’t understand the answer to be honest, and as mentioned, it does work in Windows and iOS, so I doubt it’s a misconfiguration) as well as other pages in Google. Not sure what I need to do. I found an [old Github bug report](https://github.com/lepture/authlib/issues/81) that states authlib uses a workaround for Auth0 else it generates that error, but I’m not clear how to implement the solution they offered, and it’s a pretty old bug so I don’t even know if it still applies. Here is the login() function inside user/views.py: ```auto def login(request): return oauth.auth0.authorize_redirect( request, request.build_absolute_uri(reverse("user:callback")), ) ``` And here is where the code fails, when returning the redirect(), in the callback() function: ```auto def callback(request): token = oauth.auth0.authorize_access_token(request) user = auth.authenticate(request, token=token) if user is not None: auth.login(request, user) # Email is not automagically added by Auth0 user.email = token.get('userinfo', {}).get('email', '').lower() user.save() return redirect(request.build_absolute_uri(reverse("home:home"))) return HttpResponse(status=400) ``` I realized after posting this that: 1. I should have cleared the device’s cache and tried again. 2. I should try another device. 3. I should have pasted the text of the error instead of a screenshot. I am away from my dev computer at the moment and will try these after I get back later today. ---
**Author:** ![betterautomations1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/betterautomations1/32/60209_2.png) [@betterautomations1](https://community.auth0.com/u/betterautomations1)\ **Post date:** [January 12, 2025, 3:11pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365/2 "2025-01-12T15:11:29Z")
Just found another Android device (OS version 12) and it worked. I may have a faulty emulator. It is Bluestacks (latest version); I’ll try a third Android device later, and perhaps wipe Bluestacks and/or try a different emulator. ---
**Author:** ![betterautomations1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/betterautomations1/32/60209_2.png) [@betterautomations1](https://community.auth0.com/u/betterautomations1)\ **Post date:** [January 12, 2025, 7:14pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365/3 "2025-01-12T19:14:58Z")
Cleared all data from Chrome in Bluestacks and it, too is working. Marking this one as solved. ---
**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\ **Post date:** [January 13, 2025, 1:44pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365/4 "2025-01-13T13:44:19Z")
Hi @betterautomations1 Welcome to the Auth0 Community! Thank you for sharing your solution with the rest of the community! Have a great day! Dawid ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [January 27, 2025, 1:45pm UTC](https://community.auth0.com/t/solved-android-mismatching-state-csrf-warning-state-not-equal-in-request-and-response/168365/5 "2025-01-27T13:45:00Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.