CHW-1105 SSOStateInvalid

SSO state is invalid or has already been consumed; restart the sign-in flow

Default message: SSO state is invalid or has already been consumed; restart the sign-in flow
HTTP status: 400 (client)

Problem. The IdP redirect carried a state parameter the server does not recognise or has already consumed. Cause. Classic CSRF guard — an attacker replayed a captured callback URL, or the user clicked an old email link. Fix. Restart the sign-in flow from the login page. HTTP 400.