{"record":{"id":"7b69ec61c9b87b57","repo":"prestodb/presto","slug":"state-validation-failed","errorCode":null,"errorMessage":"State validation failed","messagePattern":"State validation failed","errorType":"http","errorClass":"ChallengeFailedException","httpStatus":401,"severity":"error","filePath":"presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OAuth2Service.java","lineNumber":248,"sourceCode":"            handlerState.ifPresent(value ->\n                    tokenHandler.setTokenExchangeError(value, format(\"Authentication response could not be verified: state=%s\", value)));\n            return Response.status(BAD_REQUEST)\n                    .cookie(NonceCookie.delete())\n                    .entity(getInternalFailureHtml(\"Authentication response could not be verified\"))\n                    .build();\n        }\n    }\n\n    private Claims parseState(String state)\n            throws ChallengeFailedException\n    {\n        try {\n            return jwtParser\n                    .parseClaimsJws(state)\n                    .getBody();\n        }\n        catch (RuntimeException e) {\n            throw new ChallengeFailedException(\"State validation failed\", e);\n        }\n    }\n\n    public String getSuccessHtml()\n    {\n        return successHtml;\n    }\n\n    public String getCallbackErrorHtml(String errorCode)\n    {\n        return failureHtml.replace(FAILURE_REPLACEMENT_TEXT, getOAuth2ErrorMessage(errorCode));\n    }\n\n    public String getInternalFailureHtml(String errorMessage)\n    {\n        return failureHtml.replace(FAILURE_REPLACEMENT_TEXT, nullToEmpty(errorMessage));\n    }\n","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OAuth2Service.java#L230-L266","documentation":"OAuth2Service.parseState failed to verify the 'state' parameter of the authentication response (JWT signature/expiry/claims check threw), so the response cannot be tied back to the original authentication request; possible CSRF/replay or malformed state. The user sees a 400 with an internal-failure page and the nonce cookie is cleared.","triggerScenarios":"Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OAuth2Service.java:248 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the OAuth2 login flow to obtain a fresh state cookie","Check coordinator clock skew and oauth state signing key configuration if it fails consistently"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}