Cannot complete login: invalid state data. (Invalid nonce)

Hello,

this error message appears when the “state” parameter in the callback URL is incorrect.

The parameter value is generated by the plugin and should be relayed as-is by Microsoft after login is complete, so it is either not being generated properly or it is getting mangled in transit somehow.

For troubleshooting, could you send the portion of the callback URL (the URL of the page where the error appears) between “state=” and the next “&” symbol?

• This reply was modified 1 year, 7 months ago by Marco.

The state parameter looks correct, however I am having trouble reproducing the issue.

The login process relies on WordPress nonces, which get invalidated after logging in or when changing IP address.
Therefore, I see three possible ways to cause this issue:

• The user’s IP address changes between when the plugin redirects them to Microsoft for login and when they return; or
• The user is already logged in and uses the “Homepage / Login URL” in the plugin settings to access the site (for example, form the Office.com homepage) and login cookies are set to SameSite=Strict, which means they won’t be presented by the browser to the website when returning from Microsoft.
• The user logs in in another tab or window during the portion of the login process that takes place on Microsoft’s website.

I realize these scenarios are very unlikely. I was unable to come up with other options to trigger this error.

A list of other plugins in use may be helpful to attempt to replicate the error.

I’m sorry, unfortunately I can’t reproduce the problem. Out of your plugin list, only Allow Multiple Accounts and NinjaFirewall stand out to me as potentially being able to cause issues, although I do not know how that could happen.

I was referring to the regular WordPress login cookies.

This plugin does not use cookies itself, instead it uses WordPress’ nonce feature, which relies on an IP address for logged out users and a login cookie for logged in users.

If a user is already logged in when they start the SSO process (i.e. visiting the /sso_for_azure_ad/start/ or ?sso_for_azure_ad=start URLs shown in the plugin settings) then there may be issues if WordPress cookeis are set to SameSite=Strict, since the user would be issued a nonce tied to their login cookie, but their browser would not present that cookie to WordPress when getting redirected from the Microsoft login page back to the plugin callback page, which would then cause nonce validation to fail.