We're currently on the free version of Auth0 and we created a new project (started with this) for Auth0 for OWIN (ASP.NET) but no matter what we pass for a redirect url, we always get redirected to the root of the application after successful login.
I even looked at the Auth0.Owin source (here) and it appears that the authorize request is built correctly and looks something like:
https://myapp.auth0.com/authorize?client_id=dasojd09asudaosidj&connection=&response_type=code&state=6UwOVen2DDCHH3WgPEQ2BisyiIt9UehGo3NNtkDoxBAj3Oexyz17viCvwrkleBA7OoNw4ZdxmNCIXKk9p2sYwVFrhbzjp623Y_EDicq3biEi_AYqkKoNAltmSFyjpM6z&scope=openid%20profile
but after that goes up and comes back from auth0.com the login looks like (note that the state is different):
https://myapp.auth0.com/login?state=woSo7Y2CxjSPvKeG6al8b_OrzHFB88-P&client=dasojd09asudaosidj&protocol=oauth2&connection=&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A53474%2Fsignin-auth0&scope=openid%20profile&audience=https%3A%2F%2Fmyapp.auth0.com%2Fuserinfo
and when I inspect the decoded state, it just literally has the characters hereisthestate even though it originally had something like http://localhost:53474?query=99999.
I am trying to follow the guidelines spelled out in the documentation but it just appears that auth0.com is mucking up the state parameter when it gets it from the login call.
Am I missing a flag or setting? Shouldn't the state remain the same through the lifecycle? Is this because we are on the free tier?
