Hmbown/CodeWhale · error

xAI OIDC discovery returned {field} on a different origin th

Error message

xAI OIDC discovery returned {field} on a different origin than the issuer

What it means

Origin-binding guard in validate_discovered_oauth_endpoint: an endpoint returned by xAI's OIDC discovery must live on the same origin (scheme, host, and port) as the configured issuer. A {field} pointing at a different origin would send OAuth codes and tokens to an unrelated host, which is the classic malicious-discovery pattern, so the document is rejected.

Source

Thrown at crates/tui/src/xai_oauth.rs:1091

    let endpoint = endpoint
        .as_deref()
        .map(str::trim)
        .filter(|endpoint| !endpoint.is_empty())
        .with_context(|| format!("xAI OIDC discovery missing {field}"))?;
    let parsed = reqwest::Url::parse(endpoint)
        .with_context(|| format!("xAI OIDC discovery returned an invalid {field}"))?;
    if !matches!(parsed.scheme(), "http" | "https") {
        bail!("xAI OIDC discovery returned unsupported {field} scheme");
    }
    let issuer = reqwest::Url::parse(issuer).context("xAI OIDC issuer is not a valid URL")?;
    if issuer.scheme() == "https" && parsed.scheme() != "https" {
        bail!("xAI OIDC discovery attempted to downgrade {field} from HTTPS");
    }
    if !parsed.username().is_empty() || parsed.password().is_some() {
        bail!("xAI OIDC discovery returned credentials in {field}");
    }
    if parsed.origin() != issuer.origin() {
        bail!("xAI OIDC discovery returned {field} on a different origin than the issuer");
    }
    Ok(endpoint.to_string())
}

fn parse_oauth_json_response<T: DeserializeOwned>(
    response: reqwest::blocking::Response,
    operation: &str,
) -> Result<(reqwest::StatusCode, T)> {
    let status = response.status();
    let content_type = response
        .headers()
        .get(reqwest::header::CONTENT_TYPE)
        .and_then(|value| value.to_str().ok())
        .unwrap_or("missing")
        .to_string();
    let mut reader = response.take(OAUTH_RESPONSE_BODY_LIMIT + 1);
    let mut body = Vec::new();
    reader

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Confirm the configured issuer origin matches where xAI actually hosts its OAuth endpoints
2. Check DNS/proxy configuration for responses redirected to another origin
3. Retry the login flow to rule out a transient misresponse
4. Report the cross-origin endpoint to xAI; use XAI_API_KEY in the meantime

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:1091 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/faf977b93fe9de83. Report an issue: GitHub.