{"record":{"id":"84f8c3496160b5b2","repo":"netbirdio/netbird","slug":"failed-to-exchange-code-for-token","errorCode":null,"errorMessage":"Failed to exchange code for token","messagePattern":"Failed to exchange code for token","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"management/server/http/handlers/proxy/auth.go","lineNumber":92,"sourceCode":"\t}\n\n\toidcConfig := h.proxyService.GetOIDCConfig()\n\n\tprovider, err := oidc.NewProvider(r.Context(), oidcConfig.Issuer)\n\tif err != nil {\n\t\tlog.WithError(err).Error(\"Failed to create OIDC provider\")\n\t\thttp.Error(w, \"Failed to create OIDC provider\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\ttoken, err := (&oauth2.Config{\n\t\tClientID:    oidcConfig.ClientID,\n\t\tEndpoint:    provider.Endpoint(),\n\t\tRedirectURL: oidcConfig.CallbackURL,\n\t}).Exchange(r.Context(), r.URL.Query().Get(\"code\"), oauth2.VerifierOption(codeVerifier))\n\tif err != nil {\n\t\tlog.WithError(err).Error(\"Failed to exchange code for token\")\n\t\thttp.Error(w, \"Failed to exchange code for token\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tuserID := extractUserIDFromToken(r.Context(), provider, oidcConfig, token)\n\tif userID == \"\" {\n\t\tlog.Error(\"Failed to extract user ID from OIDC token\")\n\t\thttp.Error(w, \"Failed to validate token\", http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\t// Group validation is performed by the proxy via ValidateSession gRPC call.\n\t// This allows the proxy to show 403 pages directly without redirect dance.\n\n\tsessionToken, err := h.proxyService.GenerateSessionToken(r.Context(), redirectURL.Hostname(), userID, auth.MethodOIDC)\n\tif err != nil {\n\t\tlog.WithError(err).Error(\"Failed to create session token\")\n\t\tredirectURL.Scheme = \"https\"\n\t\tquery := redirectURL.Query()","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/http/handlers/proxy/auth.go#L74-L110","documentation":"Error \"Failed to exchange code for token\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at management/server/http/handlers/proxy/auth.go:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}