OAuth state parameter removed on redirect callback

Developer Support APIs & Integrations
1

Hi,

I am experiencing a strange use case when trying to authenticate against HubSpot with my app.

Starting with a clean session, no HubSpot cookies, I fire off my authorization URL which has the state query string parameter appended at the end, connect with my Google account against HubSpot, and when the redirect callback is invoked, I only receive the authorization code, the state parameter I passed is missing.

In the same browser session, if I fire again the same authorization URL with the state query string parameter, on redirect callback, the state parameter is present.

Basically, if it goes through the login screen, the state parameter is lost.

My install URL looks like this:

https://app-eu1.hubspot.com/oauth/authorize?client_id=df359efc-9cd5-475f-8bcb-36426b490799&redirect_uri=https://localhost:44344/umbraco/api/AuthorizedServiceResponse/HandleIdentityResponse&scope=oauth%20forms%20crm.objects.contacts.read%20crm.objects.contacts.write&state=123

Could you help me out with this situation?

Thank you,

Adrian

2

Hi, @ACojocariu :waving_hand: I’ll send you a DM with our next step.

Best,

Jaycee

3

Hi Jaycee, could get help on this as well, as we’re seeing similar issue

4

Hey, @AMoradian :waving_hand: Please send me a DM with the following details:

  • The portal ID
  • App ID you’re using for this auth URL
  • The auth URL

Thank you! — Jaycee

5

I have the same issue “OAuth state parameter removed on redirect callback”

6

We have the same issue, could we get some help on this please

7

Hi @Jaycee_Lewis - same exact issue here I sent you a message!

8

Hello, we are experiencing the same issue and this is causing issues with our integration as we rely on the `state` parameter to be passed through.

9

This specifically seems to happen when beginning the OAuth flow when not logged in to HubSpot. The state parameter is passed correctly if I am already logged in to HubSpot.

10

Hey there! Can check now? If you’re still experiencing this issue, please let me know and I’ll follow up internally again for us. @ACojocariu @bsin1 @AMoradian @pawas

Thank you! — Jaycee

11

Awesome, this looks like it’s working again :tada: Thank you!

12

Hi Jaycee, I have just tested and can confirm that it works as expected.

Thank you for helping with this!

13

works fine now. thanks for the quick response.

14

Hey @Jaycee_Lewis , facing the same issue

15

ve the same issue

16

Hi @TWissen,

Thank you for your reaching out to the HubSpot Community, this definitely sounds like unexpected behavior.

The state parameter is intended to be preserved throughout the OAuth flow, so it’s unusual that it only goes missing when the login screen is involved.
Can you please check and try the following to see if this helps:

- Make sure the state parameter is correctly appended and URL-encoded each time you initiate the flow.
These articles might be of interest:
OAuth Quickstart Guide
Public apps will require a Redirect URL in the auth settings
- Clearing all cookies, cache, and even trying in incognito/private mode can help rule out the issue.

- Sometimes, browser extensions or custom privacy settings can interfere with cookies or URL parameters during redirects. Try with all extensions disabled and/or a different browser.

Let us know if any of the above steps resolve the issue or if you gather more information, I’ll be happy to help you further!
I’d love to also consult with our Top Experts on this: Hi @sylvain_tirreau, @Anton and @himanshurauthan do you have other suggestions to help @TWissen, please?
Have a wonderful day and thanks so much in advance for your help ! :star:
Bérangère