{"record":{"id":"66236431595291b0","repo":"wandb/openui","slug":"message","errorCode":null,"errorMessage":"message","messagePattern":"message","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"backend/openui/server.py","lineNumber":330,"sourceCode":"async def callback(request: Request, error: str = \"\", error_description: str = \"\"):\n    try:\n        # if we've been given an error\n        if error != \"\":\n            logger.error(\"Oauth Error (%s): %s\", error, error_description)\n            message = \"An error occurred when attempting to login with GitHub, please try again.\"\n            if error == \"bad_verification_code\":\n                message = \"The code passed is incorrect or expired.\"\n            elif error == \"unverified_user_email\":\n                message = \"You must verify your email address with GitHub to login.\"\n            elif error == \"redirect_uri_mismatch\":\n                message = \"GitHub is not configured with the appropriate redirect url.\"\n            elif error == \"incorrect_client_credentials\":\n                message = \"The application is not configured to login with GitHub, invalid client credentials\"\n            elif error == \"application_suspended\":\n                message = \"This application has been suspended by GitHub and can't accept new logins.\"\n            elif error == \"access_denied\":\n                message = \"You've denied us access to verify your email with GitHub.\"\n            raise ValueError(message)\n        with github_sso:\n            id_token = await github_sso.verify_and_process(request)\n        # TODO: should probably key off email / update info\n        user = User.get_or_none(User.username == id_token.display_name)\n        if user is None:\n            user_id = uuid.uuid4()\n            user = User.create(\n                id=user_id.bytes,\n                username=id_token.display_name,\n                email=id_token.email,\n                created_at=datetime.now(),\n            )\n            user.id = user_id\n        elif not user.email:\n            user.email = id_token.email\n            user.save()\n        request.session[\"session_id\"] = session_store.generate_session_id()\n        request.session[\"user_id\"] = str(user.id)","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/wandb/openui/blob/42d7ab4ab6650433486dfb12eb3783c393a3e475/backend/openui/server.py#L312-L348","documentation":"Raised inside OpenUI's GitHub OAuth callback endpoint: when GitHub redirects back with an error query parameter (incorrect_client_credentials, application_suspended, access_denied, etc.), the handler builds a human-readable message and raises ValueError(message), which surfaces as an HTTP 500. It means the GitHub login flow failed before an id_token could be verified.","triggerScenarios":"Hitting /auth/github/callback with an error query param: the GitHub OAuth app has wrong client_id/client_secret, the GitHub App has been suspended by GitHub, or the user clicked 'Cancel'/'Deny' on the authorization screen.","commonSituations":"Misconfigured OAuth app credentials after rotating secrets, running against a GitHub App that GitHub suspended for policy violations, users denying the email-verification scope, or stale redirect URLs pointing at the wrong app.","solutions":["If credentials are wrong: verify GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET in the server environment match the GitHub OAuth App settings, then restart.","If suspended: contact GitHub Support to appeal the application suspension.","If access_denied: instruct the user to authorize the requested scopes; there is no server-side fix.","Check the Authorization callback URL configured in the GitHub app matches your deployed callback route."],"exampleFix":"# before (.env with rotated secret not updated)\nGITHUB_CLIENT_SECRET=old_secret\n# after\nGITHUB_CLIENT_SECRET=new_rotated_secret\n# then restart the server","handlingStrategy":"try-catch","validationCode":"# before redirecting users to GitHub, verify app config\ndef verify_github_app_config(client_id, client_secret):\n    if not client_id or not client_secret:\n        raise RuntimeError(\"GitHub OAuth credentials missing\")","typeGuard":null,"tryCatchPattern":"const res = await fetch(`/auth/github/callback?${params}`);\nif (!res.ok) {\n  const body = await res.text();\n  if (body.includes(\"incorrect_client_credentials\")) {\n    showAlert(\"Login is misconfigured; contact the administrator.\");\n  } else if (body.includes(\"access_denied\")) {\n    showAlert(\"You must authorize GitHub access to sign in.\");\n  } else {\n    showAlert(\"GitHub login failed: \" + body);\n  }\n}","preventionTips":["Rotate GitHub client secrets in sync with deployed env vars","Set the OAuth app callback URL to the exact deployed route","Monitor GitHub App suspension notices sent to the app owner","Show users a friendly page when the callback returns error params instead of a raw 500"],"tags":["oauth","github","authentication","http-500"],"backgroundTag":"oauth-callback-error","analyzedSha":"42d7ab4ab6650433486dfb12eb3783c393a3e475","analyzedAt":"2026-09-01T05:00:32.200Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}