some of the users on my site are experiencing a Laravel\Socialite\Two\InvalidStateException. I've taken the steps outlined in the replies to Laravel Socialite: InvalidStateException and have not been able to resolve the issue. Only a small percentage of users seem to be experiencing this.
I have 2 fpm/nginx docker containers sitting behind an HAProxy load balancer.
This seems to be an invalid state issue in socialite package that is already resolved in this post.
Some of your users are accessing your website with a different url (https://www.example.com or https://example.com) hence causing the mismatching "state" in the sessions.
If you are on Larvel 5.3 and above... add a SESSION_DOMAIN=http://example.com in the .env file
For other versions go to your config/session.php file, and add your domain. 'domain' => 'www.example.com'
To apply changes immediately. Run 'php artisan cache:clear' and 'composer dump-autoload' Hopefully this should resolve the issue.
I bet you that the issue is appearing because of the load balancer. Here's my theory:
Sticky sessions: if your load balancer hasn't sticky session properly configured, it's possible for some users to start a new session on server 1 and on a following request it ends on server 2 which maybe is throwing the Laravel\Socialite\Two\InvalidStateException
Request timeout: I'm not sure of this but, maybe your session lifetime isn't enough to complete some process that also throws the Laravel\Socialite\Two\InvalidStateException
Maybe if you change the laravel session storage to a decentralized database instead of the default text file configuration, the exception gets solved.
redis instance which both nginx/fpm containers share for session storage. Wouldn't that eliminate the Sticky Sessions theory?
In your production env file just add SESSION_DOMAIN=http://example.com to be picked up by your config/session.php. For local development, you won't need that.
replace
Socialite::driver('google')->user(); to this code
Socialite::driver('google')->stateless()->user(); any social (any social login like facebook github etc)
