{"record":{"id":"07c07519633628c6","repo":"netbirdio/netbird","slug":"failed-to-validate-token","errorCode":null,"errorMessage":"Failed to validate token","messagePattern":"Failed to validate token","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"management/server/http/handlers/proxy/auth.go","lineNumber":99,"sourceCode":"\t\thttp.Error(w, \"Failed to create OIDC provider\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\ttoken, err := (&oauth2.Config{\n\t\tClientID:    oidcConfig.ClientID,\n\t\tEndpoint:    provider.Endpoint(),\n\t\tRedirectURL: oidcConfig.CallbackURL,\n\t}).Exchange(r.Context(), r.URL.Query().Get(\"code\"), oauth2.VerifierOption(codeVerifier))\n\tif err != nil {\n\t\tlog.WithError(err).Error(\"Failed to exchange code for token\")\n\t\thttp.Error(w, \"Failed to exchange code for token\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tuserID := extractUserIDFromToken(r.Context(), provider, oidcConfig, token)\n\tif userID == \"\" {\n\t\tlog.Error(\"Failed to extract user ID from OIDC token\")\n\t\thttp.Error(w, \"Failed to validate token\", http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\t// Group validation is performed by the proxy via ValidateSession gRPC call.\n\t// This allows the proxy to show 403 pages directly without redirect dance.\n\n\tsessionToken, err := h.proxyService.GenerateSessionToken(r.Context(), redirectURL.Hostname(), userID, auth.MethodOIDC)\n\tif err != nil {\n\t\tlog.WithError(err).Error(\"Failed to create session token\")\n\t\tredirectURL.Scheme = \"https\"\n\t\tquery := redirectURL.Query()\n\t\tquery.Set(\"error\", \"access_denied\")\n\t\tquery.Set(\"error_description\", sessionTokenErrorDescription(err))\n\t\tredirectURL.RawQuery = query.Encode()\n\t\thttp.Redirect(w, r, redirectURL.String(), http.StatusFound)\n\t\treturn\n\t}\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/http/handlers/proxy/auth.go#L81-L117","documentation":"Error \"Failed to validate token\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at management/server/http/handlers/proxy/auth.go:99 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}