AlistGo/alist · warning

invalid request

Error message

invalid request

What it means

Returned by SSOLoginCallback when the requested method is neither 'get_sso_id' nor 'sso_get_token'. The method argument comes from the ?method= query parameter, or — in SSO compatibility mode — from the last path segment of the callback URL. The two allowed values correspond to the two callback phases: fetch the SSO user id vs. exchange it for an application token.

Source

Thrown at server/handles/ssologin.go:296

				</body>`, token)
		c.Data(200, "text/html; charset=utf-8", []byte(html))
		return
	}
}

func SSOLoginCallback(c *gin.Context) {
	enabled := setting.GetBool(conf.SSOLoginEnabled)
	usecompatibility := setting.GetBool(conf.SSOCompatibilityMode)
	if !enabled {
		common.ErrorResp(c, errors.New("sso login is disabled"), 500)
		return
	}
	argument := c.Query("method")
	if usecompatibility {
		argument = path.Base(c.Request.URL.Path)
	}
	if !utils.SliceContains([]string{"get_sso_id", "sso_get_token"}, argument) {
		common.ErrorResp(c, errors.New("invalid request"), 500)
		return
	}
	clientId := setting.GetStr(conf.SSOClientId)
	platform := setting.GetStr(conf.SSOLoginPlatform)
	clientSecret := setting.GetStr(conf.SSOClientSecret)
	var tokenUrl, userUrl, scope, authField, idField, usernameField string
	additionalForm := make(map[string]string)
	switch platform {
	case "Github":
		tokenUrl = "https://github.com/login/oauth/access_token"
		userUrl = "https://api.github.com/user"
		authField = "code"
		scope = "read:user"
		idField = "id"
		usernameField = "login"
	case "Microsoft":
		tokenUrl = "https://login.microsoftonline.com/common/oauth2/v2.0/token"
		userUrl = "https://graph.microsoft.com/v1.0/me"

View on GitHub (pinned to 843d9dc814)

Solutions

1. Call the endpoint with ?method=get_sso_id (phase 1) or ?method=sso_get_token (phase 2)
2. In compatibility mode, make the callback URL end with /get_sso_id or /sso_get_token (e.g. /api/auth/sso_callback/get_sso_id)
3. Match the frontend and backend versions so both use the same method-passing convention

Example fix

// before
GET /api/auth/sso_callback?method=get_user
// after
GET /api/auth/sso_callback?method=get_sso_id

allowed := map[string]bool{"get_sso_id": true, "sso_get_token": true}
method := c.Query("method")
if useCompatibility {
    method = path.Base(c.Request.URL.Path)
}
if !allowed[method] {
    return errors.New("method must be get_sso_id or sso_get_token")
}

if resp.StatusCode() == 500 && strings.Contains(resp.String(), "invalid request") {
    // wrong method name/path — re-issue with ?method=get_sso_id or the compatibility path suffix
}

When it happens

Trigger: Hitting the callback URL with ?method=missing/typo'd, or in compatibility mode with a path like /api/auth/sso_callback/get-user that does not end in one of the two allowed segments.

Common situations: IdP configured with a callback URL whose final path segment is wrong for compatibility mode; frontend updated to the query-string protocol against an older backend; manual testing of the endpoint with arbitrary paths.

Related errors

• sso login is disabled
• api_key is empty
• cookie is empty
• empty token
• username is empty

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/288bb1901a748925. Report an issue: GitHub.