{"record":{"id":"6465a893d4836e56","repo":"microsoft/semantic-kernel","slug":"missing-username-password-or-state-parameter","errorCode":null,"errorMessage":"Missing username, password, or state parameter","messagePattern":"Missing username, password, or state parameter","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py","lineNumber":147,"sourceCode":"                    <input type=\"password\" name=\"password\" value=\"demo_password\" required>\n                </div>\n                <button type=\"submit\">Sign In</button>\n            </form>\n        </body>\n        </html>\n        \"\"\"\n\n        return HTMLResponse(content=html_content)\n\n    async def handle_login_callback(self, request: Request) -> Response:\n        \"\"\"Handle login form submission callback.\"\"\"\n        form = await request.form()\n        username = form.get(\"username\")\n        password = form.get(\"password\")\n        state = form.get(\"state\")\n\n        if not username or not password or not state:\n            raise HTTPException(400, \"Missing username, password, or state parameter\")\n\n        # Ensure we have strings, not UploadFile objects\n        if not isinstance(username, str) or not isinstance(password, str) or not isinstance(state, str):\n            raise HTTPException(400, \"Invalid parameter types\")\n\n        redirect_uri = await self.handle_simple_callback(username, password, state)\n        return RedirectResponse(url=redirect_uri, status_code=302)\n\n    async def handle_simple_callback(self, username: str, password: str, state: str) -> str:\n        \"\"\"Handle simple authentication callback and return redirect URI.\"\"\"\n        state_data = self.state_mapping.get(state)\n        if not state_data:\n            raise HTTPException(400, \"Invalid state parameter\")\n\n        redirect_uri = state_data[\"redirect_uri\"]\n        code_challenge = state_data[\"code_challenge\"]\n        redirect_uri_provided_explicitly = state_data[\"redirect_uri_provided_explicitly\"] == \"True\"\n        client_id = state_data[\"client_id\"]","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py#L129-L165","documentation":"Raised as HTTPException(400) by SimpleAuthProvider.handle_login_callback when the submitted login form is missing username, password, or state. The POST /login/callback handler reads the three form fields and requires all three to proceed with authentication.","triggerScenarios":"The login form is submitted with any of username/password/state blank; a client posts a partial form; the form fields were renamed in the HTML but not in the handler; a scripted request omits a field.","commonSituations":"User leaves a field empty; browser autofill failure; a custom client posting malformed credentials; the hidden 'state' input was stripped from the form HTML.","solutions":["Ensure the login form includes all three fields (username, password, and the hidden state input) and the user fills username and password.","Add client-side required-field validation on the form before submission.","Verify the form HTML in get_login_page still emits the state hidden input.","For API clients, include all three fields in the POST body."],"exampleFix":"// before\n<form method=post action=/login/callback>\n  <input name=username>\n  <input name=password type=password>\n</form>\n\n// after\n<form method=post action=/login/callback>\n  <input name=username required>\n  <input name=password type=password required>\n  <input type=hidden name=state value=\"{{ state }}\">\n</form>","handlingStrategy":"validation","validationCode":"missing = [k for k in ('username','password','state') if not form.get(k)]\nif missing:\n    raise HTTPException(400, f'Missing fields: {missing}')\nawait oauth_provider.handle_login_callback(request)","typeGuard":"def form_has_required_fields(form) -> bool:\n    return all(form.get(k) for k in ('username', 'password', 'state'))","tryCatchPattern":null,"preventionTips":["Mark username/password as required in the form HTML.","Keep the hidden state input in the form template.","Add client-side validation before submit."],"tags":["oauth","authentication","mcp","http","forms","input-validation"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}