state mismatch error occurring after logging out and logging back in

[sincraianul]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

A state mismatch error occurs if logging back in immediately after log out.

Reproduction

1. Be logged in
2. Log out (hit the /api/auth/logout endpoint)
3. Be redirected back to the login page because of the middleware (shared in the "Additional context" section)
4. Log in with credentials
5. Be prompted to choose an organization (we use a multi-org flow)
6. A 400 error is thrown (state mismatch) during the callback phase

Additional context

1. We use a custom auth domain, but it doesn't seem to influence the issue

2. We use the identifier-first flow

3. We let the Universal Login prompt the user for an organization they want to use when logging in

4. We use a catch-all middleware (which is why the user gets redirected to the login page immediately after logout):

   import { withMiddlewareAuthRequired } from "@auth0/nextjs-auth0/edge";
   
   export default withMiddlewareAuthRequired();
   
   export const config = {
     matcher: [
       /*
        * Match all request paths except for the ones starting with:
        * - api (API routes)
        * - _next/static (static files)
        * - _next/image (image optimization files)
        * - favicon.ico (favicon file)
        */
       "/((?!api|_next/static|_next/image|favicon.ico).*)",
     ],
   };

5. HAR recording

6. The issue only occurs if the user is already logged in

7. The issue doesn't occur if the user navigates to the app URL manually after the error occurs. They are presented with the organization picker and the callback succeeds once they choose the org.

nextjs-auth0 version

3.5.0

Next.js version

14.0.4

Node.js version

20.9.0