{"record":{"id":"81b8b2da96129cdd","repo":"Hmbown/CodeWhale","slug":"xai-oidc-discovery-attempted-to-downgrade-field","errorCode":null,"errorMessage":"xAI OIDC discovery attempted to downgrade {field} from HTTPS","messagePattern":"xAI OIDC discovery attempted to downgrade (.+?) from HTTPS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1085,"sourceCode":"\nfn validate_discovered_oauth_endpoint(\n    endpoint: Option<String>,\n    field: &str,\n    issuer: &str,\n) -> Result<String> {\n    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"xAI OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"xAI OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"xAI OIDC discovery returned unsupported {field} scheme\");\n    }\n    let issuer = reqwest::Url::parse(issuer).context(\"xAI OIDC issuer is not a valid URL\")?;\n    if issuer.scheme() == \"https\" && parsed.scheme() != \"https\" {\n        bail!(\"xAI OIDC discovery attempted to downgrade {field} from HTTPS\");\n    }\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        bail!(\"xAI OIDC discovery returned credentials in {field}\");\n    }\n    if parsed.origin() != issuer.origin() {\n        bail!(\"xAI OIDC discovery returned {field} on a different origin than the issuer\");\n    }\n    Ok(endpoint.to_string())\n}\n\nfn parse_oauth_json_response<T: DeserializeOwned>(\n    response: reqwest::blocking::Response,\n    operation: &str,\n) -> Result<(reqwest::StatusCode, T)> {\n    let status = response.status();\n    let content_type = response\n        .headers()\n        .get(reqwest::header::CONTENT_TYPE)","sourceCodeStart":1067,"sourceCodeEnd":1103,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1067-L1103","documentation":"Security downgrade guard in validate_discovered_oauth_endpoint: when the configured issuer uses https, every endpoint advertised in the discovery document must also use https. An http endpoint for {field} would send authorization codes, device codes, or tokens in cleartext, so the mismatch is rejected rather than downgraded. The faulty input is the http(s) URL the discovery document supplied for {field}.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1085 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry discovery; a transient bad response can cause this","Verify xAI's discovery document actually lists https endpoints and that nothing on the network rewrites them to http","Remove any proxy or captive portal that strips TLS from the endpoint URLs","Report the advertised http endpoint to xAI; use XAI_API_KEY while it is unfixed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}