Nextjs-auth0: BadRequest: checks.state argument is missing (only in production environment)

[andreweinkoetz]

Description

After login via Social Providers (Google, Github) or via e-mail, I receive an 400 HTTP error stating that checks.state argument is missing. On development (localhost:3000) this problem does not exist - only in our production environment (netlify.com).

From the Auth0 logs (in dashboard) we can see that the user successfully logged in, a code is issued and the callback function (api/auth/callback) is called. Here, the checks.state error is thrown and it does not reach out to Auth0 to get an access token.

We double-checked all environment variables to make sure we don't have misspelled a key or value. When logging the environment variables values, we can see that they are correct and match the ones we are using locally (except of course for app-related URIs such as REDIRECT_URI.)

Reproduction

To reproduce, you can visit our application on https://particular.cloud/ and try to login via Google or Github.

In the serverless function on Netlify we see the following log entry:

In the browser, the following message is displayed:

Environment

• Version of this library used: 1.3.0
• Version of the platform or framework used, if applicable: NextJS: 10.1.3
• Other relevant versions (language, server software, OS, browser):
  
  
  
  • NodeJS: v12.13.0
  
  
  • Chrome, Safari (and mobile versions of them) tested
  
  
• Other modules/plugins/libraries that might be involved:
  
  
  
  • @netlify/[email protected]
  
  

[trofosila]

Same issue here for https://handledroid.com

In prod environment (Netlify) I get "BadRequest: checks.state argument is missing". When I test locally everything works OK.

I have reduced my [...auth0].ts to

import { handleAuth } from "@auth0/nextjs-auth0";

export default handleAuth();

I've seen closed issues for the same error message but I'm not setting cookie domain or sameSite. I have also read the response in the FAQ but I'm only using a single browser tab. I tried clearing the cookies for both handlredroid and auth0 domains.

I'm testing with Chrome, Chrome with 'Incognito Window' and Safari. I have also deleted my (social) user in Auth0 dashboard but it seems nothing helps.

[spectacularGavin]

We are also experiencing the exact same issue using netlify.

[Vitupero]

I'm also having the same issue using netlify.

[trofosila]

I don't think Netlify is the issue here. When I inspect the request to /api/auth/callback when I'm in localhost it has a SetCookie header for appSession cookie. On the production domain the SetCookie header for appSession is missing. To me it feels something is misconfigured in auth0 side.

Also, I have other applications hosted with Netlify and in there I'm not seeing this issue.

Hope my clarifications help with troubleshooting.

[Vitupero]

So the site I'm having issues with, is hosted on Netlify.

I had just updated it to the latest version copying a working version I have that is hosted on Azure, which is still working.

[andreweinkoetz]

I first experienced the issue after upgrading NextJS to the latest version (including an upgrade from the auth0/nextjs-auth0 1.0.0beta to the current version & the netlify-nextjs plugin).

The set-cookie header for appSession in my production is not set either @trofosila (but code & state query parameters are, as well as appSession in the cookie header)

[matthieuh]

We are also experiencing the same issue and we confirm this is a Netlify issue. We tried deploying it using Vercel or Docker and it is working fine.

[adamjmcgrath]

Hi @andreweinkoetz - it looks like it's related to this https://answers.netlify.com/t/bug-netlify-functions-event-headers-cookie-sometimes-suddenly-used-comma-instead-of-semicolon/36793/7

Netlify say "we are coordinating work to roll out a fix. I don’t have an ETA yet"

I'll keep an eye on that support forum post and make sure it resolves your problems before closing this issue

[trofosila]

For us it seems to be resolved. Will confirm in few hours if it's stable.

[andreweinkoetz]

Hey @adamjmcgrath
Thx for the info - currently it's working. I can also confirm the behavior that is described in that post.

I will keep an eye on that and get in touch with Netlify if necessary.

[trofosila]

Can confirm it looks stable. Netlify also seems to have pinpointed the source of the bug and released a fix for it.

[adamjmcgrath]

Thanks @andreweinkoetz @trofosila - think we can close this now