{"record":{"id":"8f025f2a498ba89b","repo":"gotify/server","slug":"failed-to-generate-state-v","errorCode":null,"errorMessage":"failed to generate state: %v","messagePattern":"failed to generate state: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"api/oidc.go","lineNumber":139,"sourceCode":"//\t  required: true\n//\t  type: string\n//\tresponses:\n//\t  302:\n//\t    description: Redirect to OIDC provider\n//\t  default:\n//\t    description: Error\n//\t    schema:\n//\t        $ref: \"#/definitions/Error\"\nfunc (a *OIDCAPI) LoginHandler() gin.HandlerFunc {\n\treturn gin.WrapF(func(w http.ResponseWriter, r *http.Request) {\n\t\tclientName := r.URL.Query().Get(\"name\")\n\t\tif clientName == \"\" {\n\t\t\thttp.Error(w, \"invalid client name\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tstate, err := a.generateState()\n\t\tif err != nil {\n\t\t\thttp.Error(w, fmt.Sprintf(\"failed to generate state: %v\", err), http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\ta.pendingSessions.Set(time.Now(), state, &pendingOIDCSession{ClientName: clientName, CreatedAt: time.Now()})\n\t\trp.AuthURLHandler(func() string { return state }, a.Provider, a.promptURLParams()...)(w, r)\n\t})\n}\n\n// swagger:operation GET /auth/oidc/elevate oidc oidcElevate\n//\n// Start the OIDC flow to elevate an existing client session (browser).\n//\n// Redirects the user to the OIDC provider's authorization endpoint. After\n// successful authentication, the referenced client session is elevated for\n// the requested duration.\n//\n//\t---\n//\tparameters:\n//\t- name: id","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/gotify/server/blob/14bfc256276775c425f988d621dccfe705de18ac/api/oidc.go#L121-L157","documentation":"LoginHandler calls generateState to create the CSRF/state token for the OIDC flow. If state generation fails (the error is wrapped into the response body), the handler responds with 500 'failed to generate state: <err>'.","triggerScenarios":"generateState returning an error — typically failure of its underlying randomness source (crypto/rand read error) during the login request.","commonSituations":"Degraded system entropy on constrained containers or VMs, or a misconfigured custom randomness source in tests.","solutions":["Inspect the wrapped inner error in the response body to find the root cause","Ensure the runtime has a working crypto/rand source (check entropy availability in the container)","Restart the server/process if the random source is exhausted or broken","Upgrade Go/runtime if entropy-blocking behavior at startup is the issue"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"resp, err := http.Get(loginURL)\nif resp.StatusCode == 500 {\n    body, _ := io.ReadAll(resp.Body)\n    if strings.HasPrefix(string(body), \"failed to generate state\") {\n        time.Sleep(time.Second)\n        // retry the login request once\n    }\n}","preventionTips":["Ensure containers have adequate entropy (or use newer Go with buffered crypto/rand)","Monitor for repeated 500s on the login endpoint","Keep the runtime/Go version current to avoid rand-source issues"],"tags":["oidc","security","randomness"],"backgroundTag":"state-generation-failed","analyzedSha":"14bfc256276775c425f988d621dccfe705de18ac","analyzedAt":"2026-09-05T12:52:36.781Z","contentChangedAt":"2026-09-05T12:52:36.781Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}