Laravel Socialite InvalidStateException in AbstractProvider.php line 200

Question

I'm building a web app in my local system (Ubuntu-14.04 64Bit) using laravel 5.3. I used Socialite to signin from social networks. I configured G+, Facebook, GitHug. I'm using Chromium as my default browser. Finally the problem is i'm getting

InvalidStateException in AbstractProvider.php line 200

frequently. i tried

php artisan cache:clear

php artisan config:clear

composer dump-autoload

these are helping to solve the issue temporarily, again the problem raising.

please help me in this issue..

Answer 1

I have same issue and solved in 3 steps;

1. add request on the top use Illuminate\Http\Request;

2. Pass request object to function

   public function handleProviderCallback(Request $request) { try { $user = Socialite::driver('facebook')->user(); } catch (Exception $e) { throw new Exception; } }

3. Clear cache. php artisan cache:clear

Answer 2

I was getting that exception because 'state' wasn't saved in session. But I was using asPopup method - Socialite::driver('facebook')->asPopup()->redirect(); so I saved session then - $request->session()->save();. So I solved this issue.

or try

session()->put('state', $request->input('state'));
$user = Socialite::driver('facebook')->user();

it works

Answer 3

If the AbstractProvider.php line 200 fires the exception when the state of the user is not present means that the User cannot be created.

First check your code when you get the details from the provider(facebook, github) if you create a user and you return it.

If you have managed and logged in your app and you deleted the user from the user table remember to delete also the data from the socialite account table.

Answer 4

I have the same issue and I've read a lot about this, that depend if the URL where you are at the moment of the login request has www. at the beginning or not. Into config\services.php, if you have the redirect set as http://sitename.tld/callback/facebook the oauth works if you send the login request from sitename.tld, while if you try from www.sitename.tld you get the exception.

I haven't yet understood how to have it working with and without www at the beginning.

Answer 5

I had the same error but my solution was a little different. I am posting here just in case someone else keeps hitting this post like I did for a possible answer.

I develop on Ubuntu 18.04 desktop since it is a server with a GUI. Socialite works great locally but as soon as I pushed/pulled the changes through git to the server, it quit.

I was running traces by recording what was sent to and from google. I "dd($_GET)" to get a raw dump before Socialite had a chance to get the info so I knew what was stored and ready for use. All info was there but Socialite didn't seem to "see" it. That is when I reasoned it was my apache2 header configuration interfering with the cookies/session data.

I had set header security in my apache2 configs. One of the settings was

Header always edit Set-Cookie ^(.*) "$1;HttpOnly;Secure;SameSite=Strict"

This setting was interfering with the cookie information that socialite needed. I removed that setting from my apache2 header config(by commenting out) and restarted Apache. Finally I removed all sessions in storage/framework/session/* and cleared them from my browser just to be sure. That worked for me.

After I got it working, one by one enabled and tested each of the following settings to have the framework secure what header info it can:

SESSION_SECURE_COOKIE=true

in my .env file

'http_only' => true, and 'same_site' => 'lax'(setting to "strict" did not seem to work)
in my config/session.php file.

Now it is back to testing security and tweaking things back if need be.