ASP.NET with Google authentication throws error on callback: The oauth state was missing or invalid

I'm developing a cookie authentication application with the ability to authorize through a Google account. I have a UI in React v18 and an ASP.NET Core 6 Web API. I created a web app in console.cloud.google.com and got the app credentials.

Authentication process with Google:

1. user sends request from UI to API to authorize through google (.../google/login endpoint);
2. the API redirects user to google authorization;
3. after succeed authorization it sends user to .../google/signin endpoint (registered in google).

Well, 1 - 2 works well, but I have exception on callback endpoint after succeed authorization on google side. It's not inside my controller:

> Exception: The oauth state was missing or invalid.
> Unknown location
>
> Exception: An error was encountered while handling the remote login.
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

I cannot understand how to fix it. I tried to change sign in schemas, callback paths etc, but it was useless. Here is my code:

Program.cs

#region Configure services

builder.Host.ConfigureLogging(builder => builder.AddDomainLogger());

builder.Services.AddControllers();

builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new OpenApiInfo { Title = "***", Version = "v1" });
});

// ... adding some services

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options => options.LoginPath = "/api/authorization/login")
    .AddGoogle(options =>
    {
        options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.CallbackPath = "/api/authorization/google/signin";

        options.ClientId = builder.Configuration["Authentication:Google:ClientId"];
        options.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"];

        options.Scope.Add("email"); // to get primary email address
        options.Scope.Add("profile"); // to get personal public info like name, image etc.
    });

#endregion

var app = builder.Build();

#region Configure app

// ... some logic

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "***"));
}

app.UseAuthentication();

app.UseAuthorization();

app.UseHttpsRedirection();

app.MapControllers();

#endregion

GoogleAuthorizationController.cs

[Route("api/authorization/google")]
[ApiController]
public class GoogleAuthorizationController : ControllerBase
{
    [HttpGet]
    [Route("login")]
    public Task LoginGoogle()
    {
        return HttpContext.ChallengeAsync(GoogleDefaults.AuthenticationScheme, new AuthenticationProperties()
        {
            RedirectUri = Url.Action("SignInGoogle")
        });
    }

    [HttpGet]
    [Route("signin")]
    public async Task<IActionResult> SignInGoogle() // <- it can't reach it
    {  

You don't need to configure

options.CallbackPath = "/api/authorization/google/signin";

in your configuration, The options.CallbackPath is not the path to your Controller/Action. It just must be the same as registered in your 3rd party provider (Google, or so...). It refers to a unique path handled by the auth middleware instead of controller, By default is signin-google, It will redirect back to your controller when it's done.