{"record":{"id":"29f15cf261b85e56","repo":"quarkusio/quarkus","slug":"state-query-parameter-is-not-equal-to-the-q-post","errorCode":null,"errorMessage":"'state' query parameter is not equal to the q_post_logout cookie value","messagePattern":"'state' query parameter is not equal to the q_post_logout cookie value","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java","lineNumber":51,"sourceCode":"    @GET\n    @Authenticated\n    @Path(\"logout\")\n    public String getTenantLogoutPath() {\n        throw new InternalServerErrorException();\n    }\n\n    @GET\n    @Path(\"post-logout\")\n    public String postLogout(@QueryParam(\"state\") String postLogoutState) {\n        Cookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\n        if (cookie == null) {\n            throw new InternalServerErrorException(\"q_post_logout cookie is not available\");\n        }\n        if (postLogoutState == null) {\n            throw new InternalServerErrorException(\"'state' query parameter is not available\");\n        }\n        if (!postLogoutState.equals(cookie.getValue())) {\n            throw new InternalServerErrorException(\"'state' query parameter is not equal to the q_post_logout cookie value\");\n        }\n        return \"You were logged out, please login again\";\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":56,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java#L33-L56","documentation":"The post-logout 'state' query parameter must equal the value stored in the q_post_logout_tenant-logout cookie set during the logout redirect. A mismatch indicates the callback state cannot be trusted — it may belong to a different logout session or be forged — so the endpoint rejects it.","triggerScenarios":"The state query parameter differs from the cookie value: stale cookie from a previous logout, provider echoed an old/other state, or the request was crafted with an arbitrary state.","commonSituations":"Multiple logout attempts leaving a stale cookie; cookie overwritten by a concurrent session in the same browser; provider misconfiguration sending its own state format.","solutions":["Clear stale q_post_logout cookies and restart the logout flow from the beginning","Verify only one logout flow is in flight per browser profile","Check that the provider echoes back the exact state Quarkus issued (correct post_logout_redirect_uri and client config)"],"exampleFix":"// before\nif (!postLogoutState.equals(cookie.getValue())) {\n    throw new InternalServerErrorException(\"'state' query parameter is not equal to the q_post_logout cookie value\");\n}\n// after\nif (!postLogoutState.equals(cookie.getValue())) {\n    return \"post-logout state mismatch; please log in and log out again\";\n}","handlingStrategy":"validation","validationCode":"Cookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\nString state = uriInfo.getQueryParameters().getFirst(\"state\");\nif (cookie != null && state != null && !state.equals(cookie.getValue())) {\n    // state/cookie mismatch: clear cookies and restart logout flow\n}","typeGuard":null,"tryCatchPattern":"try {\n    given().get(\"/tenant-logout/post-logout?state=...\");\n} catch (InternalServerErrorException e) {\n    if (e.getMessage().contains(\"not equal to the q_post_logout\")) {\n        // stale or forged state; clear cookies and re-login\n    }\n}","preventionTips":["Clear stale q_post_logout cookies between logout attempts","Avoid concurrent logout flows in the same browser profile","Verify the provider echoes the exact issued state"],"tags":["oidc","logout","csrf","state-mismatch"],"backgroundTag":"csrf-state-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}