An invalid request error occurs during a request to the /authorize endpoint because the state parameter is missing or contains invalid characters. Include the state parameter and ensure it contains only alphanumeric, comma, period, underscore, and hyphen characters to resolve the issue. The following error occurs during a request to the /authorize endpoint:

error: invalid_request
error_description: The authentication+request+has+an+invalid+'state'+parameter

• Okta Identity Engine (OIE)
• OAuth 2.0
• OpenID Connect (OIDC)

The state parameter in the /authorize request might be missing or contain invalid characters.

How is the Invalid state parameter error resolved?

Okta requires the OAuth 2.0 state parameter on all requests to the /authorize endpoint to prevent cross-site request forgery (CSRF). The OAuth 2.0 specification requires clients to protect redirect Uniform Resource Identifiers (URIs) against CSRF by sending a value in the authorized request that binds the request to the authenticated state of the user-agent. Using the state parameter provides a countermeasure to several other known attacks, as detailed in OAuth 2.0 Threat Model and Security Considerations.

The state parameter must contain only alphanumeric, comma, period, underscore, and hyphen characters. Review the following example of a properly formatted authorization request containing a valid state parameter.

https://${OktaDomainName}/oauth2/default/v1/authorize?client_id=0oabucvy
c38HLL1ef0h7&response_type=code&scope=openid&redirect_uri=http%3A%2F%2Flocal
host%3A8080&state=state-296bc9a0-a2a2-4a57-be1a-d0e2fd9bb601&nonce=g5ly497e8ps

Related References

• About "state" parameter
• Org Authorization Server: /authorize
• OAuth 2.0 Threat Model and Security Considerations