Kong/insomnia · error

Invalid state parameter. It looks like the authorization…

Error message

Invalid state parameter. It looks like the authorization flow was not initiated by the app.

What it means

CSRF guard in GitHubProvider.completeOAuth: the state parameter returned by the OAuth callback is not present in the in-memory githubStatesCache, meaning the callback was not initiated by this app instance (or the app restarted), so the code exchange is refused.

Solutions

1. Restart the GitHub OAuth flow from the app so a fresh state is issued
2. Avoid app restarts between initiating and completing the flow

When it happens

Trigger: Thrown at packages/insomnia/src/sync/git/providers/github.ts:297 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/923a7e3cbb0a08fb. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/sync/git/providers/github.ts:297

        authUrl: url.toString(),
        state,
      };
    } catch (error) {
      const errorMessage = error instanceof Error ? error.message : String(error);
      console.error('Failed to initiate the GitHub OAuth flow:', error);
      throw new Error(`Failed to initiate the GitHub OAuth flow: ${errorMessage}`);
    }
  }

  /**
   * Complete OAuth flow
   * Exchanges code for token and creates/updates credential in database
   */
  async completeOAuth(code: string, state: string): Promise<OAuthCompleteResult> {
    try {
      // Validate state for security (CSRF protection)
      if (!PLAYWRIGHT_TEST && !githubStatesCache.has(state)) {
        throw new Error('Invalid state parameter. It looks like the authorization flow was not initiated by the app.');
      }
      const reauthorizingCredentialId = githubStatesCache.get(state);

      // Exchange code for access token via Insomnia backend
      const response = await net.fetch(getApiBaseURL() + '/v1/oauth/github-app', {
        method: 'POST',
        body: JSON.stringify({
          code,
        }),
        headers: {
          'Content-Type': 'application/json',
        },
      });

      if (!response.ok) {
        throw new Error(`Failed to exchange code for token: ${response.statusText}`);
      }

View on GitHub (pinned to d9bb2b0142)