Calling onLoad() throws missing_transaction - Invalid state even when hasValidCredentials() returns true

[AcarFurkan]

Checklist

• The issue can be reproduced in the auth0_flutter sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

When calling auth0Web.onLoad(...), a WebException is thrown with the error code missing_transaction and message Invalid state. However, right after this exception, calling auth0Web.hasValidCredentials() returns true.

This seems inconsistent — if the state is invalid and an error is thrown during onLoad, shouldn't hasValidCredentials() also return false?

Reproduction

@override
Future<bool> initAuthSession() async {
  try {
    await auth0Web.onLoad(
      useRefreshTokens: true,
      cacheLocation: CacheLocation.localStorage,
      scopes: {'openid', 'profile', 'offline_access', 'email'},
      audience: BuildConfig.auth0_audience,
    );
    return await auth0Web.hasValidCredentials();
  } on WebException catch (e) {
    final hasValidCredentials = await auth0Web.hasValidCredentials();
    debugPrint('WebException hasValidCredentials: $hasValidCredentials ');
    debugPrint('WebException error: ${e.code} - ${e.message} - ${e.details} ');
    return false;
  } catch (e) {
    final hasValidCredentials = await auth0Web.hasValidCredentials();
    debugPrint('init Unknown hasValidCredentials: $hasValidCredentials - $e');
    return false;
  }
}

Additional context

No response

auth0_flutter version

1.9.0

Flutter version

3.29.2

Platform

Web

Platform version(s)

No response

[SAGV]

I had similar problem migrating from a much older auth0 version.

This error happens when onLoad function is called more than once. Put a log in front of the function and see how many times it's called in your app.

If it's called twice but callback code is still in url, it will fail. So you need to make sure that (a) on the callback the function is called only once and (b) the auth parameters are removed from url once it was called with them.