# State mismatch when redirecting from React marketing site to Rails App Auth0 login

**URL:** <https://community.auth0.com/t/state-mismatch-when-redirecting-from-react-marketing-site-to-rails-app-auth0-login/192886>\
**Category:** Get Help\
**Tags:** classic-universal-login-experience, login-experience\
**Created:** [October 7, 2025, 1:08pm UTC](https://community.auth0.com/t/state-mismatch-when-redirecting-from-react-marketing-site-to-rails-app-auth0-login/192886 "2025-10-07T13:08:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carolinh\_ng](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/carolinh_ng/32/72928_2.png) [@Carolinh\_ng](https://community.auth0.com/u/Carolinh_ng)\
**Post date:** [October 7, 2025, 1:08pm UTC](https://community.auth0.com/t/state-mismatch-when-redirecting-from-react-marketing-site-to-rails-app-auth0-login/192886/1 "2025-10-07T13:08:40Z")

</div>

Hi everyone 👋

I’m working on a setup with two separate domains:

- **Marketing site (React)** → `https://domain.fr`

- **SaaS app (Rails 7.2 + Devise + OmniAuth + Auth0)** → `https://app.domain.fr`

### **Goal**

When a visitor clicks “Login” on my React marketing site, I want them to land **directly on the Auth0 Universal Login page** , just like when someone visits my Rails app (`https://app.domain.fr`) for the first time.

So ideally:

- Visiting `https://app.domain.fr` → immediately redirects to Auth0 Universal Login

- Clicking “Login” on `https://domain.fr` → goes to the _same_ Auth0 login page (same flow)

* * *

### **Problem**

By default, OmniAuth in Rails expects the **authorization request** to be a `POST`, so it can store the `state` parameter in session before redirecting to Auth0.

If I allow a `GET` request (using `OmniAuth.config.allowed_request_methods = [:get, :post]`), it _works_ — both the direct visit and the button from React correctly open the Auth0 login page — but this exposes me to **CSRF vulnerabilities** ⚠

So my questions are:

1. Is there a **safe way** to handle login redirects across two domains (`domain.fr` → `app.domain.fr`) without allowing GET requests?

2. Can I somehow **preserve or synchronize the `state` parameter** so the OAuth flow remains valid even if the first request doesn’t come from the Rails domain?

### **Environment**

- Rails 7.2

- Devise + OmniAuth + OmniAuth-Auth0

- React (Vite) for the marketing site

- Auth0 Universal Login

- Local setup: `http://localhost:5173` → `https://localhost:3001`

Any advice or best practices from those who managed this multi-domain login flow would be amazing 🙏

---

<div class="post-metadata">

**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\
**Post date:** [October 8, 2025, 12:36am UTC](https://community.auth0.com/t/state-mismatch-when-redirecting-from-react-marketing-site-to-rails-app-auth0-login/192886/3 "2025-10-08T00:36:35Z")

</div>

Hi @Carolinh_ng

Welcome to the Auth0 Community!

Please allow us some time to go through the details that you shared and we will provide you with an update or some helpful documentations.

Best regards,  
Gerald