{"record":{"id":"53834b0237cbafa3","repo":"HeyPuter/puter","slug":"internal-error-53834b","errorCode":"internal_error","errorMessage":"Could not build authorization URL.","messagePattern":"Could not build authorization URL\\.","errorType":"http","errorClass":"HttpError","httpStatus":500,"severity":"error","filePath":"src/backend/controllers/oidc/OIDCController.ts","lineNumber":381,"sourceCode":"                // Bind this flow to the initiating browser: a single-use\n                // nonce lives both in the signed `state` and in an HttpOnly\n                // companion cookie. The callback requires them to match, so a\n                // `state` captured from an attacker's own flow can't be\n                // replayed in a victim's browser (login-CSRF / session\n                // fixation).\n                const browserNonce = crypto\n                    .randomBytes(32)\n                    .toString('base64url');\n                statePayload.nonce = browserNonce;\n\n                const state = this.services.oidc.signState(statePayload);\n                const url = await this.services.oidc.getAuthorizationUrl(\n                    provider,\n                    state,\n                    flow,\n                );\n                if (!url)\n                    throw new HttpError(\n                        500,\n                        'Could not build authorization URL.',\n                        { legacyCode: 'internal_error' },\n                    );\n\n                res.cookie(OIDC_NONCE_COOKIE_NAME, browserNonce, {\n                    // Same flags as the session cookie: SameSite=None;Secure\n                    // on HTTPS so the cookie survives Apple's cross-site\n                    // form_post callback; Lax on plain-HTTP self-host.\n                    ...sessionCookieFlags(this.config),\n                    httpOnly: true,\n                    maxAge: OIDC_NONCE_EXPIRY_SEC * 1000,\n                    path: '/',\n                });\n                res.redirect(302, url);\n            },\n        );\n","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/controllers/oidc/OIDCController.ts#L363-L399","documentation":"The OIDC start endpoint called `services.oidc.getAuthorizationUrl(provider, state, flow)` and it returned a falsy value, meaning the authorization URL could not be constructed. This is an internal server error — the provider is configured but the URL builder failed, likely due to missing provider metadata (issuer, authorization_endpoint) or a discovery failure.","triggerScenarios":"Provider config exists (passed the 404 check) but is incomplete — missing authorization endpoint URL, malformed issuer, or the OIDC discovery document could not be fetched/parsed. The `getAuthorizationUrl` method returned null/undefined.","commonSituations":"Provider config has a client_id/secret but no issuer URL; the IdP's discovery endpoint is unreachable from the server; the discovery document is malformed; a provider config migration left fields blank.","solutions":["Verify the provider config includes a valid `issuer` URL pointing to the IdP's OIDC discovery endpoint.","Check server-side network connectivity to the IdP — the discovery fetch may be timing out or blocked by a firewall.","Confirm the IdP supports OIDC discovery (`.well-known/openid-configuration`).","Check backend logs for the underlying error from `getAuthorizationUrl`."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  window.location = `/auth/oidc/${provider}/start`;\n} catch (e) {\n  if (e.code === 'internal_error' && e.message.includes('authorization URL')) {\n    console.error('OIDC provider misconfigured. Contact the administrator.');\n  }\n}","preventionTips":["Self-hosters: verify each provider config has a valid `issuer` URL that serves OIDC discovery.","Test network connectivity from the server to the IdP's discovery endpoint.","Log the underlying error from `getAuthorizationUrl` for faster diagnosis."],"tags":["oidc","authentication","config","internal-error","http-500","network"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}