{"record":{"id":"730f345d12b629be","repo":"langflow-ai/langflow","slug":"an-error-occurred-during-authentication","errorCode":null,"errorMessage":"An error occurred during authentication","messagePattern":"An error occurred during authentication","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"src/backend/base/langflow/api/v1/login.py","lineNumber":56,"sourceCode":"    form_data: Annotated[OAuth2PasswordRequestForm, Depends()],\n    db: DbSession,\n):\n    \"\"\"Login endpoint with rate limiting applied via app.state.limiter.\"\"\"\n    # Check rate limit (limiter is initialized in main.py after settings load)\n    check_rate_limit(request)\n\n    auth_settings = get_settings_service().auth_settings\n    try:\n        auth = get_auth_service()\n        user = await auth.authenticate_user(form_data.username, form_data.password, db, request)\n    except Exception as exc:\n        if isinstance(exc, HTTPException):\n            raise\n        # Log the actual error server-side but don't expose it to clients\n        from loguru import logger\n\n        logger.error(f\"Authentication error: {exc}\")\n        raise HTTPException(\n            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n            detail=\"An error occurred during authentication\",\n        ) from exc\n\n    if user:\n        tokens = await auth.create_user_tokens(user_id=user.id, db=db, update_last_login=True)\n        response.set_cookie(\n            \"refresh_token_lf\",\n            tokens[\"refresh_token\"],\n            httponly=auth_settings.REFRESH_HTTPONLY,\n            samesite=auth_settings.REFRESH_SAME_SITE,\n            secure=auth_settings.REFRESH_SECURE,\n            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,\n            domain=auth_settings.COOKIE_DOMAIN,\n        )\n        response.set_cookie(\n            \"access_token_lf\",\n            tokens[\"access_token\"],","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/login.py#L38-L74","documentation":"500 from POST /api/v1/login when authenticate_user raises an unexpected (non-HTTP) exception — DB down, password-hasher misconfigured, custom auth plugin crash. The real error is logged server-side ('Authentication error: ...') and deliberately hidden from the client so internals are not leaked. Bad credentials do NOT produce this; they raise 401.","triggerScenarios":"POST /login while the database is unreachable; a custom auth_service plugin (registered via lfx.services entry point) raising; misconfigured secret key making token/hashing setup fail.","commonSituations":"DB container not up at deploy time; auth plugin version mismatch after upgrade; LANGFLOW_SECRET_KEY missing/rotated; LDAP/OAuth backend behind login crashing.","solutions":["Check server log for 'Authentication error: <exc>' — the actual exception is there","Verify DB connectivity and that the user table is reachable","If using a custom auth_service plugin, test its authenticate_user directly","Confirm required auth settings (secret key, auth backend config) are set in the environment"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    tokens = await client.post(\"/api/v1/login\", data={\"username\": u, \"password\": p})\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 500:\n        raise AuthInfrastructureError(\"login backend broken; check server logs\") from e\n    raise","preventionTips":["Distinguish 500 (server broken) from 401 (bad credentials) in login error handling","Keep DB and custom auth plugins healthy; test authenticate_user after plugin upgrades","Pin a stable LANGFLOW_SECRET_KEY across restarts"],"tags":["auth","login","http-500","langflow"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}