{"record":{"id":"da25fd7a762ae6c0","repo":"nextauthjs/next-auth","slug":"state-data-was-provided-but-the-provider-is-not-co","errorCode":null,"errorMessage":"State data was provided but the provider is not configured to use state","messagePattern":"State data was provided but the provider is not configured to use state","errorType":"exception","errorClass":"InvalidCheck","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/checks.ts","lineNumber":162,"sourceCode":"interface EncodedState {\n  origin?: string\n  random: string\n}\n\nconst STATE_MAX_AGE = 60 * 15 // 15 minutes in seconds\nconst encodedStateSalt = \"encodedState\"\n\n/**\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-10.12\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1\n */\nexport const state = {\n  /** Creates a state cookie with an optionally encoded body. */\n  async create(options: InternalOptions<\"oauth\">, origin?: string) {\n    const { provider } = options\n    if (!provider.checks.includes(\"state\")) {\n      if (origin) {\n        throw new InvalidCheck(\n          \"State data was provided but the provider is not configured to use state\"\n        )\n      }\n      return\n    }\n\n    // IDEA: Allow the user to pass data to be stored in the state\n    const payload = {\n      origin,\n      random: o.generateRandomState(),\n    } satisfies EncodedState\n    const value = await encode({\n      secret: options.jwt.secret,\n      token: payload,\n      salt: encodedStateSalt,\n      maxAge: STATE_MAX_AGE,\n    })\n    const cookie = await sealCookie(\"state\", value, options)","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/checks.ts#L144-L180","documentation":"state.create throws InvalidCheck when an `origin`/state body was supplied to encode into the state cookie, but the provider's `checks` array does not include \"state\". The library only stores state data for providers opted into the state check, so passing state data otherwise is treated as a config inconsistency.","triggerScenarios":"Calling signIn or a provider flow with custom state/redirect data (e.g. authorization params callbackUrl encoded in state) while the provider config lacks checks: [\"state\"] (or has only [\"pkce\"]/[\"nonce\"]).","commonSituations":"Custom OAuth provider definitions copied without `checks: [\"state\"]` while the app passes extra state; switching provider type from oidc to oauth and dropping the checks array; programmatic signIn calls passing origin but misconfigured provider.","solutions":["Add \"state\" to the provider's checks array: checks: [\"state\"] (optionally alongside \"pkce\").","Or stop passing state/origin data for providers that don't use the state check.","Review custom provider definitions to ensure the checks array matches the features you use."],"exampleFix":"// before\nconst Provider = {\n  id: \"custom\",\n  type: \"oauth\",\n  checks: [\"pkce\"],\n  // ...\n}\n// after\nconst Provider = {\n  id: \"custom\",\n  type: \"oauth\",\n  checks: [\"state\", \"pkce\"],\n  // ...\n}","handlingStrategy":"validation","validationCode":"const checks = providerConfig.checks ?? []\nif (wantsStateData && !checks.includes(\"state\")) {\n  throw new Error(\"Add 'state' to provider checks before passing state data\")\n}","typeGuard":"function supportsState(p: { checks?: string[] }): boolean {\n  return (p.checks ?? []).includes(\"state\")\n}","tryCatchPattern":null,"preventionTips":["Include checks: [\"state\"] on custom OAuth providers that need state","Align the checks array with the features your sign-in calls use","Review provider configs after migrating between oauth/oidc types"],"tags":["oauth","state","configuration","checks"],"backgroundTag":"oauth-state-check-misconfigured","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}