OAuth 2.0 regression / authorization rejects numeric-only state values

Дата публикации: 27-08-2026 16:35:54

The X OAuth 2.0 authorization endpoint rejects valid state values when they contain only digits. Adding a single alphabetic character to the same state makes the otherwise identical authorization request succeed.
This appears to be a recent regression in X’s OAuth 2.0 authorization flow. After a recent X update, these requests began failing at the X authorization endpoint. Prefixing the existing state with one alphabetic character immediately restores the previously working behavior.
Endpoint
GET https://x.com/i/oauth2/authorize
Steps to reproduce
Configure an X OAuth 2.0 application with a valid callback URL.
Start an Authorization Code flow with PKCE.
Use this state:
state=388136898008186883
The authorization fails immediately before the consent page is displayed:
Something went wrong
You weren’t able to give access to the App.
Go back and try logging in again.
Repeat the same request, changing only the state:
state=x388136898008186883
Consent page is displayed, authorization now succeeds.
Failing request
https://x.com/i/oauth2/authorize
?client_id=<CLIENT_ID>
&code_challenge=<CODE_CHALLENGE>
&code_challenge_method=S256
&redirect_uri=<REGISTERED_CALLBACK>
&response_type=code
&scope=users.email+users.read+tweet.read
&state=388136898008186883
Working request
https://x.com/i/oauth2/authorize
?client_id=<CLIENT_ID>
&code_challenge=<CODE_CHALLENGE>
&code_challenge_method=S256
&redirect_uri=<REGISTERED_CALLBACK>
&response_type=code
&scope=users.email+users.read+tweet.read
&state=x388136898008186883
The only difference is the x prefix.
Expected behavior
state should be handled as an opaque string. Authorization should succeed and the callback should receive the exact value:
state=388136898008186883
X’s documentation describes state as a string of up to 500 characters and does not prohibit numeric-only values.
Actual behavior
Large numeric-only states are rejected during authorization. Adding a nonnumeric character makes the request succeed.
Impact
Identity Manager that generates snowflake-style numeric identifiers (our case) such as 388136898008186883 for OAuth state fails unless the state is modified to contain a nonnumeric character.
2 posts - 2 participants
Read full topic

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	OAuth 2.0 PKCE authorization fails after user approval before callback	0	7.24	28-08-2026
2	OAuth 2.0/authorize fails with 'Something went wrong' on Pay Per Use tier. Al settings verified: billing, enrollment, callback, credentials	0	7.65	30-08-2026
3	Pay-Per-Use: compliance jobs upload_url / download_url return 404 (control plane works) — App ID 33340874	0	11.64	27-08-2026
4	API authorization issue OAuth2	0	8.78	28-08-2026
5	Pay-Per-Use app: OAuth 1.0a user context returns 401 on both GET and POST v2 endpoints	0	10.43	27-08-2026
6	X Can't post link	0	9.12	30-08-2026
7	X API v2 returns HTTP 500 with empty response body across multiple endpoints	0	8.24	27-08-2026
8	App Suspended (28881659) but Account in Good Standing, can still post	0	8.99	27-08-2026
9	Ads API 403 and App Manager cannot resolve JTP iOS and Android identifiers	0	7.88	28-08-2026
10	Do human-reviewed AI reply suggestions need additional approval?	0	9.98	27-08-2026

Классификация: . Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 9.79. Источник: twittercommunity.com.