{"record":{"id":"2a613eeac0f2abef","repo":"BookStackApp/BookStack","slug":"errors-oidc-already-logged-in","errorCode":null,"errorMessage":"errors.oidc_already_logged_in","messagePattern":"errors\\.oidc_already_logged_in","errorType":"exception","errorClass":"OidcException","httpStatus":null,"severity":"error","filePath":"app/Access/Oidc/OidcService.php","lineNumber":218,"sourceCode":"        }\n\n        try {\n            $idToken->validate($settings->clientId);\n        } catch (OidcInvalidTokenException $exception) {\n            throw new OidcException(\"ID token validation failed with error: {$exception->getMessage()}\");\n        }\n\n        $userDetails = $this->getUserDetailsFromToken($idToken, $accessToken, $settings);\n        if (empty($userDetails->email)) {\n            throw new OidcException(trans('errors.oidc_no_email_address'));\n        }\n        if (empty($userDetails->name)) {\n            $userDetails->name = $userDetails->externalId;\n        }\n\n        $isLoggedIn = auth()->check();\n        if ($isLoggedIn) {\n            throw new OidcException(trans('errors.oidc_already_logged_in'));\n        }\n\n        try {\n            $user = $this->registrationService->findOrRegister(\n                $userDetails->name,\n                $userDetails->email,\n                $userDetails->externalId\n            );\n        } catch (UserRegistrationException $exception) {\n            throw new OidcException($exception->getMessage());\n        }\n\n        if ($this->config()['fetch_avatar'] && !$user->avatar()->exists() && $userDetails->picture) {\n            $this->userAvatars->assignToUserFromUrl($user, $userDetails->picture);\n        }\n\n        if ($this->shouldSyncGroups()) {\n            $detachExisting = $this->config()['remove_from_groups'];","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Oidc/OidcService.php#L200-L236","documentation":"BookStack throws this when an OIDC callback/authorization flow is processed while a user is already authenticated (auth()->check() is true). The OIDC login flow is only meant to run for logged-out users, so it refuses to proceed to avoid hijacking or corrupting the existing session.","triggerScenarios":"processAccessTokenCallback runs and auth()->check() returns true — e.g. an already-logged-in user hits the OIDC callback URL (/social/oidc/callback or /oidc/callback) directly, retries an old authorize URL from a bookmark, or a second browser tab completes the OIDC flow after they logged in another way.","commonSituations":"User bookmarks the callback URL, opens the login URL while already logged in, session cookies persist across an IdP-initiated SSO redirect, or stale authorize-link emails are clicked.","solutions":["Log out of BookStack before initiating OIDC login (visit /logout or let session expire)","Start the OIDC flow from the BookStack login page rather than saved/deep links to the callback","Clear stale BookStack session cookies (XSRF-TOKEN, session cookie) in the browser","If it happens for all users after an IdP change, verify the OIDC login entry point is not being embedded in authenticated pages"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Client-side guard: don't start OIDC flow when a session exists\nif (document.cookie.includes(document.getElementById('session-cookie-name')?.value)) {\n    // already logged in — skip the /oidc/login redirect\n}","typeGuard":null,"tryCatchPattern":"// Server-side: detect and treat as a no-op redirect\ntry {\n    auth()->attemptOidcLogin();\n} catch (BookStack\\Access\\Oidc\\OidcException $e) {\n    if (trans('errors.oidc_already_logged_in') === $e->getMessage()) {\n        return redirect('/'); // already authenticated; just send home\n    }\n    throw $e;\n}","preventionTips":["Never bookmark or share OIDC callback URLs; start flows from the login page","Clear stale session cookies when switching accounts","Avoid IdP-initiated SSO directly into the callback endpoint","Purge old authorize links from emails/notifications"],"tags":["oidc","session","authentication"],"backgroundTag":"already-authenticated-session","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}