Problem statement
This article explains whether it is possible to validate the value in the state parameter, for example, if the characters are alphanumeric.
Solution
The values in the state parameter are an internal artifact within the Auth0 Authorization Server. Those should be handled as opaque values. Applying or checking any validation on those in terms of size, length, format, etc. is not supported.