Hmbown/CodeWhale · error

xAI OIDC discovery attempted to downgrade {field} from HTTPS

Error message

xAI OIDC discovery attempted to downgrade {field} from HTTPS

What it means

Security downgrade guard in validate_discovered_oauth_endpoint: when the configured issuer uses https, every endpoint advertised in the discovery document must also use https. An http endpoint for {field} would send authorization codes, device codes, or tokens in cleartext, so the mismatch is rejected rather than downgraded. The faulty input is the http(s) URL the discovery document supplied for {field}.

Source

Thrown at crates/tui/src/xai_oauth.rs:1085

fn validate_discovered_oauth_endpoint(
    endpoint: Option<String>,
    field: &str,
    issuer: &str,
) -> Result<String> {
    let endpoint = endpoint
        .as_deref()
        .map(str::trim)
        .filter(|endpoint| !endpoint.is_empty())
        .with_context(|| format!("xAI OIDC discovery missing {field}"))?;
    let parsed = reqwest::Url::parse(endpoint)
        .with_context(|| format!("xAI OIDC discovery returned an invalid {field}"))?;
    if !matches!(parsed.scheme(), "http" | "https") {
        bail!("xAI OIDC discovery returned unsupported {field} scheme");
    }
    let issuer = reqwest::Url::parse(issuer).context("xAI OIDC issuer is not a valid URL")?;
    if issuer.scheme() == "https" && parsed.scheme() != "https" {
        bail!("xAI OIDC discovery attempted to downgrade {field} from HTTPS");
    }
    if !parsed.username().is_empty() || parsed.password().is_some() {
        bail!("xAI OIDC discovery returned credentials in {field}");
    }
    if parsed.origin() != issuer.origin() {
        bail!("xAI OIDC discovery returned {field} on a different origin than the issuer");
    }
    Ok(endpoint.to_string())
}

fn parse_oauth_json_response<T: DeserializeOwned>(
    response: reqwest::blocking::Response,
    operation: &str,
) -> Result<(reqwest::StatusCode, T)> {
    let status = response.status();
    let content_type = response
        .headers()
        .get(reqwest::header::CONTENT_TYPE)

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Retry discovery; a transient bad response can cause this
2. Verify xAI's discovery document actually lists https endpoints and that nothing on the network rewrites them to http
3. Remove any proxy or captive portal that strips TLS from the endpoint URLs
4. Report the advertised http endpoint to xAI; use XAI_API_KEY while it is unfixed

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:1085 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/81b8b2da96129cdd. Report an issue: GitHub.