{"record":{"id":"58091031fab91a75","repo":"ory/hydra","slug":"invalid-request","errorCode":"invalid_request","errorMessage":"existing user code signature","messagePattern":"existing user code signature","errorType":"error_code","errorClass":"fosite.RFC6749Error","httpStatus":400,"severity":"error","filePath":"persistence/sql/persister_device.go","lineNumber":168,"sourceCode":"\t\tDeviceCodeActive:  true,\n\t\tUserCodeState:     r.GetUserCodeState(),\n\t}, nil\n}\n\n// CreateDeviceCodeSession creates a new device code session and stores it in the database. Implements DeviceAuthStorage.\nfunc (p *Persister) CreateDeviceAuthSession(ctx context.Context, deviceCodeSignature, userCodeSignature string, requester fosite.DeviceRequester) (err error) {\n\tctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.CreateDeviceCodeSession\")\n\tdefer otelx.End(span, &err)\n\n\treq, err := p.sqlDeviceSchemaFromRequest(ctx, deviceCodeSignature, userCodeSignature, requester, requester.GetSession().GetExpiresAt(fosite.DeviceCode).UTC())\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := sqlcon.HandleError(p.CreateWithNetwork(ctx, req)); errors.Is(err, sqlcon.ErrConcurrentUpdate()) {\n\t\treturn errors.Wrap(fosite.ErrSerializationFailure, err.Error())\n\t} else if errors.Is(err, sqlcon.ErrUniqueViolation()) {\n\t\treturn errors.Wrap(fosite.ErrExistingUserCodeSignature, err.Error())\n\t} else if err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// GetDeviceCodeSession returns a device code session from the database. Implements DeviceAuthStorage.\nfunc (p *Persister) GetDeviceCodeSession(ctx context.Context, signature string, session fosite.Session) (_ fosite.DeviceRequester, err error) {\n\tctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.GetDeviceCodeSession\")\n\tdefer otelx.End(span, &err)\n\n\tr := DeviceRequestSQL{}\n\tif err = p.QueryWithNetwork(ctx).Where(\"device_code_signature = ?\", signature).First(&r); errors.Is(err, sql.ErrNoRows) {\n\t\treturn nil, errors.WithStack(fosite.ErrNotFound)\n\t} else if err != nil {\n\t\treturn nil, sqlcon.HandleError(err)\n\t}","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/persistence/sql/persister_device.go#L150-L186","documentation":"CreateDeviceAuthSession wraps fosite.ErrExistingUserCodeSignature (hint \"existing user code signature\", code invalid_request) when the INSERT fails with a unique-violation error from the database. This means a device authorization row with the same user code signature already exists — user codes are random strings and a collision, or a duplicate submission, triggered the uniqueness constraint on the user_code signature column.","triggerScenarios":"A generated 8-character user code collides with an existing, still-live device authorization row; calling the device authorization endpoint twice with the same forced user code; re-inserting a request after a retried transaction committed partially.","commonSituations":"Very small user code alphabets or custom short user codes increasing collision probability; tests that reuse the same user code across runs without cleanup; load tests replaying captured requests.","solutions":["Retry the device authorization request — the server generates a fresh random user code and the collision will (almost certainly) not repeat.","If user codes are customizable/forced, ensure uniqueness before calling CreateDeviceAuthSession.","Purge expired/stale device rows if the table is saturated with long-lived entries causing collisions.","If seen in tests, use unique user codes per test case or clean the device table between runs."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if errors.Is(err, fosite.ErrExistingUserCodeSignature) {\n    // collision: regenerate user code / re-issue device authorization\n}","preventionTips":["Let the server generate user codes from a large alphabet; avoid forcing/short codes.","Clean expired device authorization rows periodically.","In tests, use unique user codes and reset the device table between cases."],"tags":["database","unique-constraint","oauth2","device-flow"],"backgroundTag":"unique-constraint-violation","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}