v4: Setting sameSite: "none" property for the transactionCookie breaks login

[msallent]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

A few weeks back I requested the ability to configure the transactionCookie in #1866 as it was done in v3. This was implemented, however, if I make any changes to it then login never works and returns the following error:

[InvalidStateError: The state parameter is invalid.] {
  code: 'invalid_state',
  name: 'InvalidStateError'
}

Reproduction

1. Initialize your Auth0Client as following:

new Auth0Client({
  transactionCookie: {
    sameSite: 'none',
  },
  ...
});

2. Try logging in
3. Get the following error:

[InvalidStateError: The state parameter is invalid.] {
  code: 'invalid_state',
  name: 'InvalidStateError'
}

Additional context

I need to change the sameSite property for Cypress to be able to log in when running locally. I had the same issue in v3 but it was solved by setting sameSite: isLocalhost ? "none" : undefined. I tried to replicate this behavior with v4 but it's not working as expected.

nextjs-auth0 version

4.0.2

Next.js version

14.2.21

Node.js version

18.20.3

[tusharpandey13]

Thank you for reporting this issue. We're working on a fix for the next release.
In the meantime, please try this workaround:

new Auth0Client({
  transactionCookie: {
    sameSite: isLocalhost ? "none" : "lax",
    secure: isLocalhost ? false : true // Explicitly handle localhost vs production
  },
})

Please let us know if this solution works for your setup!

[msallent]

Thank you for reporting this issue. We're working on a fix for the next release. In the meantime, please try this workaround:

new Auth0Client({
transactionCookie: {
sameSite: isLocalhost ? "none" : "lax",
secure: isLocalhost ? false : true // Explicitly handle localhost vs production
},
})
Please let us know if this solution works for your setup!

I remember trying that but tried it again just in case, and didn't work. It shows the same The state parameter is invalid. error unfortunately.