Login failure "State does not match" and 504 Gateway Timeout

[Bandit]

Describe the bug

I was able to login yesterday, but now I can't. Nothing has changed since then with the configuration.

Expected behavior

I should be able to login

Additional context

services:
  server:
    image: yooooomi/your_spotify_server
    restart: always
    ports:
      - "8180:8080"
    links:
      - mongo
    depends_on:
      - mongo
    environment:
      API_ENDPOINT: https://spotifystatsapi.[redacted].nz # This MUST be included as a valid URL in the spotify dashboard (see below)
      CLIENT_ENDPOINT: https://spotifystats.[redacted].nz
      SPOTIFY_PUBLIC: [redacted]
      SPOTIFY_SECRET: [redacted]
      TIMEZONE: Pacific/Auckland

  web:
    image: yooooomi/your_spotify_client
    restart: always
    ports:
      - "3100:3000"
    environment:
      API_ENDPOINT: https://spotifystatsapi.[redacted].nz
      TIMEZONE: Pacific/Auckland

  mongo:
    container_name: mongo
    image: mongo:8
    volumes:
      - ./your_spotify_db:/data/db

I'm using Nginx Proxy Manager and Cloudflare to create SSL certs for this

[info] [7/13/2026, 10:11:57 AM] [James N]: 1 tracks, 1 albums, 1 artists
[info] [7/13/2026, 10:13:56 AM] [DbLoop] starting for 1 users
[info] [7/13/2026, 10:13:56 AM] [James N]: refreshing...
GET /me 200 7.849 ms - 16
GET /me 200 3.216 ms - 16
GET /oauth/spotify 302 0.849 ms - 423
GET /oauth/spotify 302 2.424 ms - 423
GET /oauth/spotify/callback?code=MASKED&state=9OVlIO-7pbHdHkb3PWVlYy3bd82oCv7O8pgswzLHLYU - - ms - -
GET /favicon.ico 404 3.473 ms - 150
GET /oauth/spotify/callback?code=MASKED&state=xi6mH6J7fSKApPiG8Y_KKf5TcWMa9AX2q190aFK9y2c - - ms - -
[error] [7/13/2026, 10:17:17 PM] Error: State does not match
    at file:///app/apps/server/build/index.js:162362:19
    at Layer.handleRequest (file:///app/apps/server/build/index.js:70227:17)
    at next (file:///app/apps/server/build/index.js:70483:13)
    at withGlobalPreferences (file:///app/apps/server/build/index.js:162032:9)
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
GET /oauth/spotify/callback?code=MASKED&state=9OVlIO-7pbHdHkb3PWVlYy3bd82oCv7O8pgswzLHLYU 302 2.907 ms - 65
GET /me 304 2.007 ms - -
GET /oauth/spotify 302 0.417 ms - 423
GET /oauth/spotify/callback?code=MASKED&state=RhI9_V4qyxxzSEru46spsVd-uO1J69bnF_3eYojeRRE - - ms - -
GET /oauth/spotify 302 0.917 ms - 423
GET /static/your_spotify_1200.png 404 2.551 ms - 167
GET /oauth/spotify/callback?code=MASKED&state=7mw12KgpkxifX2Cqvql_Rim_7Ai5CxLiRWwX1E4_v0Q - - ms - -
[info] [7/13/2026, 10:23:27 PM] Trying to connect to database at mongodb://mongo:27017/your_spotify
[info] [7/13/2026, 10:23:36 PM] Connected to database !
[info] [7/13/2026, 10:23:36 PM] Checking database for missing track data...

Looks like the state is not matching? Not sure what that means

Just noticed the timestamp is jumping around as well - from 10:13AM to 10:17PM (unless these are just old logs that happen to be 12 hours apart)

Screenshots

[Bandit]

This briefly worked last night and is now not working again. Same 504 gateway timeout but no state error this time (though there is a NotLoggedIn error during my import)

GET /imports 304 3.988 ms - -
[error] [7/15/2026, 12:30:11 PM] NotLoggedError
    at logged (file:///app/apps/server/build/index.js:161985:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
  type: 'UNAUTHORIZED',
  code: 'NOT_LOGGED'
}
GET /imports 401 5.871 ms - 43
GET /me 200 3.765 ms - 16
GET /global/preferences 304 2.488 ms - -
GET /oauth/spotify 302 1.833 ms - 423
GET /oauth/spotify/callback?code=MASKED&state=32qa1xX3F2xFIy1TCx5uwP_g9ccBi9cPvet03RC83d8 - - ms - -

[chaosen3]

So I had this issue myself in a new deployment of YourSpotify where it would always happen after failed import attempts, only way to be able to log into the dashboard again was to restart the containers - seems to be the same issue reported in #619