{"record":{"id":"11dd2b52803fd399","repo":"zed-industries/zed","slug":"oauth-state-mismatch","errorCode":null,"errorMessage":"OAuth state mismatch","messagePattern":"OAuth state mismatch","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/openai_subscribed/src/openai_subscribed.rs","lineNumber":1171,"sourceCode":"        // Deliberately excludes `api.connectors.read api.connectors.invoke`\n        // (which Codex CLI requests): extra scopes inflate the\n        // access-token JWT, and the serialized credentials must fit within\n        // Windows Credential Manager's 2560-byte blob limit\n        // (CRED_MAX_CREDENTIAL_BLOB_SIZE). See #58541.\n        .append_pair(\"scope\", \"openid profile email offline_access\")\n        .append_pair(\"response_type\", \"code\")\n        .append_pair(\"code_challenge\", &challenge)\n        .append_pair(\"code_challenge_method\", \"S256\")\n        .append_pair(\"id_token_add_organizations\", \"true\")\n        .append_pair(\"state\", &oauth_state)\n        .append_pair(\"codex_cli_simplified_flow\", \"true\")\n        .append_pair(\"originator\", \"zed\");\n\n    // Open browser AFTER the listener is ready\n    cx.update(|cx| cx.open_url(auth_url.as_str()));\n\n    // Await the callback\n    let callback = callback_rx\n        .await\n        .map_err(|_| anyhow!(\"OAuth callback was cancelled\"))?\n        .context(\"OAuth callback failed\")?;\n\n    // Validate CSRF state\n    if callback.state != oauth_state {\n        return Err(anyhow!(\"OAuth state mismatch\"));\n    }\n\n    let tokens = exchange_code(&http_client, &callback.code, &verifier, &redirect_uri)\n        .await\n        .context(\"Token exchange failed\")?;\n\n    let jwt = tokens\n        .id_token\n        .as_deref()\n        .unwrap_or(tokens.access_token.as_str());\n    let claims = extract_jwt_claims(jwt);","sourceCodeStart":1153,"sourceCodeEnd":1189,"githubUrl":"https://github.com/zed-industries/zed/blob/5a9b9558db01a6b906cec2fb70a797affdc58cdd/crates/openai_subscribed/src/openai_subscribed.rs#L1153-L1189","documentation":"The `state` query parameter returned in the OAuth callback does not match the value generated for this authorization request. This is the standard CSRF guard for OAuth; a mismatch means the callback belongs to a different or stale flow, or the state was tampered with.","triggerScenarios":"Thrown at crates/openai_subscribed/src/openai_subscribed.rs:1139 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Discard the callback and restart sign-in to generate a fresh state","Close any other tabs or sessions mid-sign-in that could deliver a stale callback","If it persists, verify nothing on the network path rewrites redirect URLs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5a9b9558db01a6b906cec2fb70a797affdc58cdd","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}