{"record":{"id":"3c52e926733e76d6","repo":"Tencent/WeKnora","slug":"oidc-token-response-missing-access-token-and-id-to","errorCode":null,"errorMessage":"OIDC token response missing access_token and id_token","messagePattern":"OIDC token response missing access_token and id_token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1573,"sourceCode":"\treq.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\tresp, err := newOIDCHTTPClient().Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to exchange OIDC code: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode < 200 || resp.StatusCode >= 300 {\n\t\t_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 2048))\n\t\treturn nil, fmt.Errorf(\"OIDC token exchange failed: status=%d\", resp.StatusCode)\n\t}\n\n\tvar tokenResp oidcTokenResponse\n\tif err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode OIDC token response: %w\", err)\n\t}\n\tif strings.TrimSpace(tokenResp.AccessToken) == \"\" && strings.TrimSpace(tokenResp.IDToken) == \"\" {\n\t\treturn nil, errors.New(\"OIDC token response missing access_token and id_token\")\n\t}\n\treturn &tokenResp, nil\n}\n\nfunc (s *userService) resolveOIDCUserInfo(ctx context.Context, cfg *config.OIDCAuthConfig, tokenResp *oidcTokenResponse) (*types.OIDCUserInfo, error) {\n\tclaims := map[string]interface{}{}\n\tverifiedFromIDToken := false\n\n\tif idToken := strings.TrimSpace(tokenResp.IDToken); idToken != \"\" {\n\t\tif strings.TrimSpace(cfg.JwksURI) == \"\" {\n\t\t\tif strings.TrimSpace(cfg.UserInfoEndpoint) == \"\" || strings.TrimSpace(tokenResp.AccessToken) == \"\" {\n\t\t\t\treturn nil, errors.New(\"cannot verify OIDC id_token: no jwks_uri configured\")\n\t\t\t}\n\t\t\tlogger.Warnf(ctx, \"OIDC id_token ignored: no jwks_uri configured; relying on userinfo endpoint\")\n\t\t} else {\n\t\t\tidTokenClaims, err := s.verifyOIDCIDToken(ctx, cfg, idToken)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"OIDC id_token verification failed: %w\", err)","sourceCodeStart":1555,"sourceCodeEnd":1591,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1555-L1591","documentation":"Raised in exchangeOIDCCode when the IdP's token response decodes successfully but contains neither an access_token nor an id_token — the exchange produced no usable credential. Response-shape validation on the OIDC token endpoint output.","triggerScenarios":"Thrown at internal/application/service/user.go:1573 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP's token endpoint behavior and the client_id/client_secret/redirect_uri configuration","Check the error field of the token response — the IdP may be returning an error-shaped body with 2xx"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}