This is a simplified authentication demo. Use the demo credentials below:
\nUsername: demo_user
","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py#L82-L118","documentation":"Raised as HTTPException(400) by SimpleAuthProvider.get_login_page when the state argument is falsy (empty string or None). The provider generates the login form HTML keyed to state; an empty state cannot be associated with the pending authorization, so it refuses to render.","triggerScenarios":"get_login_page('') or get_login_page(None); the upstream handler passed an empty/missing state; state was coerced to empty during URL parsing.","commonSituations":"A handler that does not check state before calling get_login_page; URL parsing edge cases producing empty state; tests invoking get_login_page without state.","solutions":["Ensure callers (login_page_handler) pass a non-empty state to get_login_page.","Validate state at the HTTP boundary before reaching get_login_page (the route handlers already do this — confirm they are on the call path).","Generate and persist state during the authorize step so it is always present.","Return a user-facing error page instead of raising for known-empty state if appropriate."],"exampleFix":"// before\nawait oauth_provider.get_login_page(state='')\n\n// after\nstate = request.query_params.get('state')\nif not state:\n raise HTTPException(400, 'Missing state parameter')\nawait oauth_provider.get_login_page(state=state)","handlingStrategy":"validation","validationCode":"if not state:\n raise HTTPException(400, 'Missing state parameter')\nawait oauth_provider.get_login_page(state)","typeGuard":"def is_non_empty_state(state) -> bool:\n return isinstance(state, str) and bool(state.strip())","tryCatchPattern":null,"preventionTips":["Validate state at the HTTP route before calling get_login_page.","Generate and persist state during authorize.","Add unit tests asserting get_login_page rejects empty state."],"tags":["oauth","authentication","mcp","http","input-validation"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}