\"\n + message.replace(\"&\", \"&\").replace(\"<\", \"<\")\n + \"
\"\n ).encode()\n writer.write(","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/inference/openai_codex_auth.py#L316-L352","documentation":"Raised as CodexAuthError by the loopback HTTP handler when the incoming callback request path is not OPENAI_CODEX_CALLBACK_PATH or the query 'state' parameter does not equal flow.state. The state check is the standard OAuth CSRF defense binding the callback to this exact flow. The except block is deliberately conservative: an unmatched state alone does NOT poison the flow unless it was consumed, so a stray request cannot kill a pending authorization.","triggerScenarios":"A browser tab with a stale authorization redirect from an earlier flow hits the loopback port while a new flow listens (state differs); another local application or scanner requests a random path on the loopback port; the state query parameter is dropped or URL-encoded differently than generated; two flows share the same port.","commonSituations":"User reuses an old browser tab holding the previous consent redirect; port reuse across sequential flows so an old callback lands on a new server; the callback URL was hand-edited; browser extensions stripping query parameters.","solutions":["Return to Studio and complete the flow from its current authorization URL — a mismatched stray request does not abort the pending flow.","Ensure a fresh authorization URL is used after restarting a flow (do not rely on cached/old tabs).","If hand-copying URLs, copy the complete URL including the state and code query parameters unmodified.","Verify only one flow's loopback server is bound to the port at a time."],"exampleFix":"// before\n# user pastes an old redirect: http://127.0.0.1:PORT/callback?state=OLD&code=OLD\nawait complete_browser_flow(provider_id, flow_id, old_url)\n\n// after\n# always copy the callback URL produced by the CURRENT authorization attempt\nflow = codex_auth.start_browser_flow(provider_id, persist_bundle)\nawait complete_browser_flow(provider_id, flow.id, current_callback_url)","handlingStrategy":"try-catch","validationCode":"from urllib.parse import urlparse, parse_qs\n\np = urlparse(callback_url)\nq = parse_qs(p.query)\nif q.get(\"state\", [\"\"])[0] != flow.state or p.path != codex_auth.OPENAI_CODEX_CALLBACK_PATH:\n reject(\"stale or foreign callback\")","typeGuard":"def callback_state_matches(callback_url: str, flow: codex_auth.OAuthFlow) -> bool:\n import secrets\n from urllib.parse import urlparse, parse_qs\n q = parse_qs(urlparse(callback_url).query)\n return secrets.compare_digest(q.get(\"state\", [\"\"])[0], flow.state)","tryCatchPattern":"try:\n handle_callback(flow, callback_url)\nexcept codex_auth.CodexAuthError as exc:\n if \"state did not match\" in str(exc):\n ignore() # stray request; pending flow is deliberately NOT poisoned\n else:\n raise","preventionTips":["Always launch the authorization from the current flow's URL; close old tabs.","Never mix callbacks between concurrent flows.","Remember a state mismatch alone does not abort the pending flow — you can just retry with the correct URL.","Copy callback URLs wholesale; hand-editing breaks state."],"tags":["oauth","csrf","state-mismatch","loopback-server","codex"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}