{"record":{"id":"89252ab2bffc9524","repo":"quarkusio/quarkus","slug":"state-query-parameter-is-not-available","errorCode":null,"errorMessage":"'state' query parameter is not available","messagePattern":"'state' query parameter is not available","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java","lineNumber":48,"sourceCode":"    // It is needed for the proactive-auth=false to work: /tenant-logout/logout should match a user initiated logout request\n    // which must be handled by `CodeAuthenticationMechanism`.\n    // Adding `@Authenticated` gives control to `CodeAuthenticationMechanism` instead of RestEasy.\n    @GET\n    @Authenticated\n    @Path(\"logout\")\n    public String getTenantLogoutPath() {\n        throw new InternalServerErrorException();\n    }\n\n    @GET\n    @Path(\"post-logout\")\n    public String postLogout(@QueryParam(\"state\") String postLogoutState) {\n        Cookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\n        if (cookie == null) {\n            throw new InternalServerErrorException(\"q_post_logout cookie is not available\");\n        }\n        if (postLogoutState == null) {\n            throw new InternalServerErrorException(\"'state' query parameter is not available\");\n        }\n        if (!postLogoutState.equals(cookie.getValue())) {\n            throw new InternalServerErrorException(\"'state' query parameter is not equal to the q_post_logout cookie value\");\n        }\n        return \"You were logged out, please login again\";\n    }\n}\n","sourceCodeStart":30,"sourceCodeEnd":56,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java#L30-L56","documentation":"The post-logout callback requires the OIDC 'state' query parameter that the provider appends when redirecting back after logout. Quarkus OIDC correlates this state with the q_post_logout cookie. A missing parameter means the callback was not produced by a genuine provider post-logout redirect.","triggerScenarios":"A request reaches /tenant-logout/post-logout without the ?state=... query parameter — direct navigation, or the provider did not include state in its post-logout redirect.","commonSituations":"Manually bookmarking or reloading the post-logout URL; provider (Keycloak) configured without post_logout_redirect_uri so state handling differs; interrupted logout flow.","solutions":["Complete the full logout flow so the provider redirects back with the state parameter","Do not call /post-logout directly; start from the logout endpoint","Check that the post-logout redirect URI given to the provider matches the endpoint exactly"],"exampleFix":"// before\nif (postLogoutState == null) {\n    throw new InternalServerErrorException(\"'state' query parameter is not available\");\n}\n// after\nif (postLogoutState == null) {\n    return \"state parameter missing; restart the logout flow\";\n}","handlingStrategy":"validation","validationCode":"if (uriInfo.getQueryParameters().getFirst(\"state\") == null) {\n    // not a genuine provider post-logout callback; redirect to logout start\n}","typeGuard":null,"tryCatchPattern":"try {\n    given().get(\"/tenant-logout/post-logout\");\n} catch (InternalServerErrorException e) {\n    if (e.getMessage().contains(\"'state' query parameter\")) {\n        // provider did not echo state; check provider redirect config\n    }\n}","preventionTips":["Reach post-logout only through the provider's logout redirect","Ensure post_logout_redirect_uri passed to the provider matches the endpoint","Avoid bookmarking the post-logout URL"],"tags":["oidc","logout","state"],"backgroundTag":"missing-state-parameter","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}