{"record":{"id":"56a4e377d6d0304c","repo":"paperclipai/paperclip","slug":"oauth-redirect-rejected","errorCode":"oauth_redirect_rejected","errorMessage":"Remote OAuth endpoint redirected unexpectedly","messagePattern":"Remote OAuth endpoint redirected unexpectedly","errorType":"http","errorClass":"HttpError","httpStatus":502,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":1410,"sourceCode":"    command: template.command ?? null,\n    args: template.args ?? [],\n    envKeys: template.envKeys ?? [],\n    tools: template.tools.map((tool) => ({\n      name: tool.name,\n      title: tool.title ?? null,\n      description: tool.description ?? null,\n      inputSchema: tool.inputSchema ?? { type: \"object\", properties: {} },\n      annotations: tool.annotations ?? {},\n    })),\n  };\n}\n\nfunction toStdioCommandTemplate(row: typeof toolStdioCommandTemplates.$inferSelect): ToolStdioCommandTemplate {\n  return {\n    id: row.id,\n    companyId: row.companyId,\n    templateId: row.templateKey,\n    name: row.name,\n    title: row.name,\n    description: row.description,\n    status: row.status,\n    source: \"admin\",\n    command: row.command,\n    args: row.args ?? [],\n    envKeys: row.envKeys ?? [],\n    tools: (row.tools ?? [])\n      .map((tool) => normalizeToolDescriptor(tool))\n      .filter((tool): tool is McpToolDescriptor => Boolean(tool))\n      .map((tool) => ({\n        name: tool.name,\n        title: tool.title ?? null,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? { type: \"object\", properties: {} },\n        annotations: tool.annotations ?? {},\n      })),\n    createdByAgentId: row.createdByAgentId,","sourceCodeStart":1392,"sourceCodeEnd":1428,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-access.ts#L1392-L1428","documentation":"SSRF/redirect safety guard in fetchRemoteHttpUrl: a redirect Location could not be re-validated by assertRemoteHttpUrlAllowed (or was missing/malformed), so following it is refused. Protects OAuth/token endpoints from redirect-based SSRF; the redirecting remote endpoint is at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:1404 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The OAuth endpoint sent an unexpected redirect. Verify the provider's authorization/issuer URL configuration and that no proxy is rewriting redirects."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}