I am trying to set up Facebook login. It connected to Facebook, I logged in and gave it permission, it redirected back to my Flarum and then says, "Invalid state. Please try again." Which is a Flarum error. What could make the "state" not right? I tried emptying cache and cookies. After some Google searches and searching here I'm thinking no one will 100% know. I suppose I could try disabling other extensions.
A little while later...
Ok, I couldn't get Facebook login to work so on to Twitter log in, and, haha:
Received HTTP status code [401] with message "{"errors":[{"code":32,"message":"Could not authenticate you."}]}" when getting temporary credentials.
Going to try Google next... if that fails then I guess social login is not for me. 😆
Seconds later... Invalid state error with Google login, just like I got with Facebook.
More seconds later after a Google search... some information on this "state"...
This may or may not be how Flarum does it.
When you call ->redirect(), this bundle gets a state value (a random string) and stores it in the session.
The bundle asks the Facebook OAuth library to generate the "redirect" URL to Facebook internally, this knows what the "state" is and includes it on that URL. This is to tell Facebook "Hey! when you redirect back to us later, include this state query parameter.
After the user is redirected back to your site from Facebook, you call ->getAccessToken() (or maybe ->fetchUser(), which calls getAccessToken()). This method looks for the state query parameter on the URL, which should be there because we asked Facebook to include it when redirecting back to us. We make sure this matches what's in the session.
And so, my Flarum installation is having trouble with sessions, and/or this state query parameter not matching up?
I can see the callback auth URL in my browser's console which does include a state parameter with a random string.
