BookStackApp/BookStack · error · SocialSignInException

errors.social_no_action_defined

Error message

errors.social_no_action_defined

What it means

SocialSignInException thrown in SocialController::callback when the session has no 'social-callback' key. The callback endpoint is only meaningful in the middle of a social login flow; the session key records which action (login/register/attach) initiated it. Without it the code cannot know what to do with the OAuth response.

Source

Thrown at app/Access/Controllers/SocialController.php:63

    public function register(string $socialDriver)
    {
        $this->registrationService->ensureRegistrationAllowed();
        session()->put('social-callback', 'register');

        return $this->socialAuthService->startRegister($socialDriver);
    }

    /**
     * The callback for social login services.
     *
     * @throws SocialSignInException
     * @throws SocialDriverNotConfigured
     * @throws UserRegistrationException
     */
    public function callback(Request $request, string $socialDriver)
    {
        if (!session()->has('social-callback')) {
            throw new SocialSignInException(trans('errors.social_no_action_defined'), '/login');
        }

        // Check request for error information
        if ($request->has('error') && $request->has('error_description')) {
            throw new SocialSignInException(trans('errors.social_login_bad_response', [
                'socialAccount' => $socialDriver,
                'error'         => $request->input('error_description'),
            ]), '/login');
        }

        $action = session()->pull('social-callback');

        // Attempt login or fall-back to register if allowed.
        $socialUser = $this->socialAuthService->getSocialUser($socialDriver);
        if ($action === 'login') {
            try {
                return $this->socialAuthService->handleLoginCallback($socialDriver, $socialUser);
            } catch (SocialSignInAccountNotUsed $exception) {

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Restart the social login from the beginning (visit /login/service/{driver} again) so the session flag is set
2. Verify APP_URL and session cookie settings so the session survives the redirect to/from the OAuth provider
3. Ensure Redis/database session storage is shared across all app servers in multi-server deployments
4. Check the browser is not blocking third-party cookies needed for the session

if (!session()->has('social-callback')) {
    return redirect('/login');
}

try {
    $result = $socialController->callback($request, $driver);
} catch (\BookStack\Access\Exceptions\SocialSignInException $e) {
    return redirect($e->redirect)->with('error', $e->getMessage());
}

When it happens

Trigger: Hitting /login/service/{driver}/callback (or equivalent social callback URL) directly, or when the session entry 'social-callback' was lost between the redirect to the provider and the return trip.

Common situations: User opens the callback URL from history/bookmark; cookies blocked or session expired while at the IdP consent screen; APP_URL mismatch causing session cookie domain change; load-balanced setup without shared session storage.

Related errors

• errors.social_login_bad_response
• errors.social_account_in_use
• errors.error_user_exists_different_creds
• errors.social_account_not_used
• errors.login_user_not_found

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/a982cd0f2fbf24d3. Report an issue: GitHub.