v4.4.x | Empty onCallback context for InvalidStateError, `returnTo` missing.

[jesseflikweerteo]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Whenever we route someone to e.g. /auth/login?prompt=none&returnTo=/somepath and the auth fails with an AuthorizationError we get a context with the returnTo url (e.g. /somepath). That's nice, since we can use that to present someone with a 'try logging in again' button that links to /auth/login?returnTo=/somepath, to make sure the user still ends up where they originally wanted to go.

However, when that same auth request fails with an InvalidStateError, the context is an empty object, and the returnTo seems to be missing. In this case the user is just lost in our webapp, since we're supposed to be relying on the returnTo URL's. Is this missing context on some callback errors a bug or a feature?

Reproduction

Route user that's not logged in to /auth/login?prompt=none&returnTo=/somepath to make sure the user gets an error, then based on chance (we still don't know when the user gets either an InvalidStateError or an AuthorizationError:
a) In case of an InvalidStateError, notice that you get an empty context, so without a returnTo url.
b) In case of an AuthorizationError, notice that you get the context you expected, so with a returnTo url.

The same happens for auth0.startInteractiveLogin({returnTo: '/somepath', ...}), regardless of how you pass the returnTo to an auth request: in case of an InvalidStateError the context seems to be missing.

Additional context

No response

nextjs-auth0 version

v4.4.0

Next.js version

v14.2.28

Node.js version

v20.10.0

[jesseflikweerteo]

I see that in the auth-client.test.ts this seems to pass the tests, see the InvalidStateError test and the AuthorizationError test. I do wonder why :)

[frederikprijck]

When you pass returnTo, the following happens:

• We put returnTo in the transaction cookie to be able to retrieve the value when we come back from auth0.
• Then we redirect to auth0
• When we are redirected back to our application, we read the transaction and get the returnTo again to use.

In the case where an InvalidStateError happens, you can see that this happens because we do not have a transaction here. When we have no transaction, we can not know what returnTo is, so not having access to returnTo in that case is by design.

[jesseflikweerteo]

Nice, thanks for explaining! Would you happen to know some ways there's "sometimes" no transaction after being redirected back to an application?