{"record":{"id":"1768d971d485b666","repo":"Wei-Shaw/sub2api","slug":"xai-oauth-response-exceeds-2-mib","errorCode":null,"errorMessage":"xAI OAuth response exceeds 2 MiB","messagePattern":"xAI OAuth response exceeds 2 MiB","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/internal/pkg/xai/sso_device.go","lineNumber":281,"sourceCode":"\t\tif cookie := f.cookieHeader(request.URL); cookie != \"\" {\n\t\t\trequest.Header.Set(\"Cookie\", cookie)\n\t\t}\n\t\tif currentForm != nil {\n\t\t\trequest.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\t\t}\n\n\t\tresponse, err := f.client.Do(request)\n\t\tif err != nil {\n\t\t\treturn 0, currentURL, nil, err\n\t\t}\n\t\tf.captureCookies(request.URL, response)\n\t\tdata, readErr := io.ReadAll(io.LimitReader(response.Body, ssoMaxAuthBody+1))\n\t\t_ = response.Body.Close()\n\t\tif readErr != nil {\n\t\t\treturn response.StatusCode, currentURL, nil, readErr\n\t\t}\n\t\tif len(data) > ssoMaxAuthBody {\n\t\t\treturn response.StatusCode, currentURL, nil, errors.New(\"xAI OAuth response exceeds 2 MiB\")\n\t\t}\n\t\tif response.StatusCode < 300 || response.StatusCode > 399 {\n\t\t\treturn response.StatusCode, currentURL, data, nil\n\t\t}\n\n\t\tlocation := strings.TrimSpace(response.Header.Get(\"Location\"))\n\t\tif location == \"\" {\n\t\t\treturn response.StatusCode, currentURL, data, errors.New(\"xAI OAuth redirect missing Location\")\n\t\t}\n\t\tbase, _ := url.Parse(currentURL)\n\t\tnext, err := url.Parse(location)\n\t\tif err != nil {\n\t\t\treturn response.StatusCode, currentURL, data, err\n\t\t}\n\t\tcurrentURL = base.ResolveReference(next).String()\n\t\tif !safeXAIAuthURL(currentURL) {\n\t\t\treturn response.StatusCode, currentURL, data, errors.New(\"xAI OAuth redirected to untrusted host\")\n\t\t}","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/Wei-Shaw/sub2api/blob/073e92d17178a1ccdb0a27017f572f10c9c7ab62/backend/internal/pkg/xai/sso_device.go#L263-L299","documentation":"The SSO HTTP helper reads at most ssoMaxAuthBody+1 bytes (2 MiB) from any OAuth response; reading more than 2 MiB produces this error. OAuth endpoints should return small JSON/HTML payloads, so an oversized body almost always means the endpoint returned something unexpected (a huge HTML page, an error wall, or a looping redirect body).","triggerScenarios":"Any request in the device flow (start, verify, approve, token) whose response body exceeds 2 MiB: xAI serving a large challenge/captcha page, a WAF returning a bloated block page, or a proxy injecting content.","commonSituations":"Cloudflare/WAF block pages; misconfigured hosts returning full SPA bundles; corporate SSL-inspection proxies appending content; xAI incident serving error pages.","solutions":["Retry after a short delay to rule out a transient block page.","Bypass corporate proxies / SSL inspection for the xAI OAuth hosts.","Hit the failing endpoint manually with the same cookies to see what the huge body actually is.","If the block is persistent (WAF rule on your egress IP), change egress IP or contact the provider."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"exceeds 2 MiB\") {\n    time.Sleep(2 * time.Second)\n    err = flow.Start(ctx) // WAF/block pages are usually transient\n}","preventionTips":["Bypass SSL-inspection proxies for xAI hosts","Alert on this error: it usually indicates WAF blocking your egress IP","Do not raise the 2 MiB cap to 'fix' it — find what is serving the huge body"],"tags":["xai","sso","size-limit","http"],"backgroundTag":null,"analyzedSha":"073e92d17178a1ccdb0a27017f572f10c9c7ab62","analyzedAt":"2026-08-15T14:33:00.750Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}