{"record":{"id":"3320a12ecf1fdb8e","repo":"Hmbown/CodeWhale","slug":"xai-oidc-discovery-returned-credentials-in-field","errorCode":null,"errorMessage":"xAI OIDC discovery returned credentials in {field}","messagePattern":"xAI OIDC discovery returned credentials in (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1088,"sourceCode":"    field: &str,\n    issuer: &str,\n) -> Result<String> {\n    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"xAI OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"xAI OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"xAI OIDC discovery returned unsupported {field} scheme\");\n    }\n    let issuer = reqwest::Url::parse(issuer).context(\"xAI OIDC issuer is not a valid URL\")?;\n    if issuer.scheme() == \"https\" && parsed.scheme() != \"https\" {\n        bail!(\"xAI OIDC discovery attempted to downgrade {field} from HTTPS\");\n    }\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        bail!(\"xAI OIDC discovery returned credentials in {field}\");\n    }\n    if parsed.origin() != issuer.origin() {\n        bail!(\"xAI OIDC discovery returned {field} on a different origin than the issuer\");\n    }\n    Ok(endpoint.to_string())\n}\n\nfn parse_oauth_json_response<T: DeserializeOwned>(\n    response: reqwest::blocking::Response,\n    operation: &str,\n) -> Result<(reqwest::StatusCode, T)> {\n    let status = response.status();\n    let content_type = response\n        .headers()\n        .get(reqwest::header::CONTENT_TYPE)\n        .and_then(|value| value.to_str().ok())\n        .unwrap_or(\"missing\")\n        .to_string();","sourceCodeStart":1070,"sourceCodeEnd":1106,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1070-L1106","documentation":"Credential-hygiene guard in validate_discovered_oauth_endpoint: the parsed URL for {field} must not carry userinfo (user:pass@host). Credentials embedded in a discovered endpoint would leak into logs, history, and every subsequent request, so their presence is treated as a malformed or hostile discovery document rather than being silently stripped.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1088 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry discovery to rule out a corrupted or tampered response","Check for proxies or rewritten discovery responses that inject userinfo into endpoint URLs","Confirm with xAI that their discovery document does not embed credentials; use XAI_API_KEY while unresolved"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}