{"record":{"id":"2b4ca172ad960927","repo":"theonedev/onedev","slug":"unsolicited-oidc-response","errorCode":null,"errorMessage":"Unsolicited OIDC response","messagePattern":"Unsolicited OIDC response","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java","lineNumber":414,"sourceCode":"\t\t\t\t\tjson.get(\"authorization_endpoint\").asText(),\n\t\t\t\t\tjson.get(\"token_endpoint\").asText(), \n\t\t\t\t\tjson.get(\"userinfo_endpoint\").asText(),\n\t\t\t\t\tendSessionEndpointNode != null ? endSessionEndpointNode.asText() : null);\n\t\t} catch (IOException | URISyntaxException e) {\n\t\t\tif (e.getMessage() != null) {\n\t\t\t\tlogger.error(_T(\"Error discovering OIDC metadata\"), e);\n\t\t\t\tthrow new AuthenticationException(e.getMessage());\n\t\t\t} else {\n\t\t\t\tthrow new RuntimeException(e);\n\t\t\t}\n\t\t}\n\t\t\n\t}\n\t\n\tprotected ProviderMetadata getCachedProviderMetadata() {\n\t\tProviderMetadata metadata = (ProviderMetadata) Session.get().getAttribute(SESSION_ATTR_PROVIDER_METADATA);\n\t\tif (metadata == null)\n\t\t\tthrow new AuthenticationException(_T(\"Unsolicited OIDC response\"));\n\t\treturn metadata;\n\t}\n\t\n}\n","sourceCodeStart":396,"sourceCodeEnd":419,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java#L396-L419","documentation":"OpenIdConnector's OAuth callback handling receives an OIDC response whose state parameter does not match an outstanding authentication request (state mismatch or absent session data), so the response cannot be tied to the initiated flow and is treated as unsolicited — a common sign of replay, stale tabs, or CSRF state mismatch.","triggerScenarios":"Thrown at server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java:414 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the SSO login flow from the OneDev login page.","Clear stale cookies/session state and retry; avoid re-submitting old callback URLs.","Verify provider state handling and clock/session lifetime settings."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}