Does endless loop of authenticating

[dougmeredith]

It successfully redirects me to the identity provider, which asks for me to grant access. I click to approve, and access is granted, and then the browser seems to be stuck in a loop authenticating over and over.

This is the output from oidc-test-client:

time="2025-06-07T16:37:30Z" level=info msg=/ method=GET remoteAddr="172.17.0.1:41696"
time="2025-06-07T16:37:31Z" level=info msg="/auth/callback?code=2QJr8oavLY09e33cLxVgkaRSmCgUVX2Q&state=9eqotJSRKBU8Cw8kmz3QGfFeTgBKhhF0fzE4wjqTIrs" method=GET remoteAddr="10.160.2.4:35068"
time="2025-06-07T16:37:31Z" level=error msg="state did not match"
time="2025-06-07T16:37:31Z" level=info msg=/ method=GET remoteAddr="10.160.2.4:35068"
time="2025-06-07T16:37:32Z" level=info msg="/auth/callback?code=fuckppc1uRfzIK7s6pC3rni3a8rVWfuc&state=dY%2B12U4CxzQliOq0M%2F%2FN2ubyCNp7XRYKkP3UPK3%2BloY" method=GET remoteAddr="10.160.2.4:35068"
time="2025-06-07T16:37:32Z" level=error msg="state did not match"

State did not match. Anyone know what that could mean?

[msilcher]

Same here, testing it against Keycloak. I don't know how to proceed.

[dougmeredith]

I should note that I was using Pocket ID.

[mkarliner]

Same here, using authentik. Any advice would be very welcome.

[carl-unique]

I have similar issues with connecting to dexidp, what i see is that the callback?code=xxx changes after authenticating to dexidp and i dont know why, maybe the session/cookie or something changes after the login request?

ok i could mitigate the issue be assuring right CORS (allowing the app-ingress (app.kind.local) also connecting to dex, which listens on another subdomain (auth.kind.loca) ) parameters in ingress and having HTTPS enabled, so all requests (app, dex) are using https.