BerriAI/litellm · error · ProxyException

Invalid OAuth state parameter — does not match the browser-b

Error message

Invalid OAuth state parameter — does not match the browser-bound state cookie.

What it means

Error "Invalid OAuth state parameter — does not match the browser-bound state cookie." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:1594

        # Get authorization code from query params (only used in the PKCE path below;
        # the non-PKCE path delegates to verify_and_process which handles OAuth error
        # callbacks — user-denied, CSRF mismatch — internally).
        authorization_code: Final = request.query_params.get("code")

        if code_verifier:
            # State-to-session-cookie binding.  The non-PKCE branch below
            # delegates to fastapi-sso's ``verify_and_process``, which
            # performs its own session-cookie check.  The PKCE branch
            # bypasses that helper, so we validate the URL ``state``
            # against the ``litellm_oauth_state`` cookie set on the
            # redirect response — without this an attacker can pre-mint
            # a state + cached PKCE verifier and hijack a victim's auth
            # code (Login-CSRF / token theft).
            url_state: Final = request.query_params.get("state")
            cookie_state: Final = request.cookies.get("litellm_oauth_state")
            if not url_state or not cookie_state or not secrets.compare_digest(url_state, cookie_state):
                raise ProxyException(
                    message=("Invalid OAuth state parameter — does not match the browser-bound state cookie."),
                    type=ProxyErrorTypes.auth_error,
                    param="state",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not authorization_code:
                raise ProxyException(
                    message="Missing authorization code in callback",
                    type=ProxyErrorTypes.auth_error,
                    param="code",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not generic_client_id:
                raise ProxyException(
                    message="GENERIC_CLIENT_ID must be set when PKCE is enabled",
                    type=ProxyErrorTypes.auth_error,
                    param="GENERIC_CLIENT_ID",
                    code=status.HTTP_401_UNAUTHORIZED,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Restart the SSO login flow in the same browser (cookies must be preserved); do not open the callback URL in a different browser.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:1594 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/43226df52a90d192. Report an issue: GitHub.