Invalid State

[peteralewis]

When running through the Xero connection login within the CMS, it gets through to the permission for access panel (Xero side) and when selecting "Allow Access", it returns to the CMS with the correct return URL, but shows a white screen with the error "invalid state" (generated on line 95 of the below file).

I looked up on Xero developer portal and verified the "state" code was in the URL and the handshake was done all at the same time, so couldn't have timed out. Digging into the plugin code (src/controllers/AuthController.php line 91), the state query string is present, so has to be that it's not matching the session oauth2state variable. I couldn't find how the state variable is originally passed to Xero for it to be able to return it...?

Any help appreciated as this is a blocker.

[peteralewis]

Also the docs might need to be updated as this seems to be the latest integration popup: