Q:

Passport-auth0 - infinite redirect loop, "Invalid authorization request state."

I'm trying to get a basic Auth0 app running. I followed the Node example on the Auth0 dashboard but I ran into an infinite redirect loop between /login and /callback. I tried to simplify the code using the getting started example of this repo's readme, right now my routing code looks like this:
app.get('/login',
      passport.authenticate('auth0', {scope: 'openid email profile'}),
      (req, res) => res.redirect("/")
    )

    app.get("/callback", 
      passport.authenticate('auth0', {failureRedirect: '/login'}),
      (req, res) => {
        if(!req.user) throw new Error("user null")
        res.redirect("/")
      }
    )

Everything about my setup follows the instructions I got on my Auth0 dashboard.
I did some digging and found out that /login is called twice, then /callback is called twice, then /login twice and so on and so on. I also found out that if I give the /callback's passport.authenticate a callback, it receives these arguments: null, false, {message: "Invalid authorization request state."}
Google didn't find anything meaningful when I searched for the phrase "Invalid authorization request state." and I did everything according to the docs. Any idea what I'm doing wrong?

A:

It turns out I didn't have the /callback route set up properly. This is the proper setup:
router.get("/callback", (req, res, next) => {
  passport.authenticate('auth0', (err, user, info) => {
    if(err) return next(err)
    if(!user) return res.redirect("/failure?info=" + JSON.stringify(info))

    req.logIn(user, err => {
      if(err) return next(err)

      const returnTo = req.session.returnTo
      delete req.session.returnTo
      res.redirect(returnTo || '/secret')
    })
  })(req, res, next)
})

res.redirect should lead somewhere else and req.logIn needs to be called with the proper arguments

