the last few things.

middleware/passport.js

@@ -7,7 +7,8 @@ const strategy = new Auth0Strategy({
   domain: config.auth0.domain,
   clientID: config.auth0.clientId,
   clientSecret: config.auth0.secret, // Replace this with the client secret for your app
-  callbackURL: config.root + "/auth/callback"
+  callbackURL: config.root + "/auth/callback",
+  state: true,
   }, (accessToken, refreshToken, extraParams, profile, done) => {
     // accessToken is the token to call Auth0 API (not needed in the most cases)
     // extraParams.id_token has the JSON Web Token

middleware/session.js

@@ -6,7 +6,7 @@ module.exports = session({
   secret: config.session.secret,
   store: new RedisStore(config.redis),
   cookie: {
-    secure: config.session.secure
+    secure: config.session.secure,
   },
   resave: false,
   saveUninitialized: true,