{"record":{"id":"923a7e3cbb0a08fb","repo":"Kong/insomnia","slug":"invalid-state-parameter-it-looks-like-the-authori","errorCode":null,"errorMessage":"Invalid state parameter. It looks like the authorization flow was not initiated by the app.","messagePattern":"Invalid state parameter\\. It looks like the authorization flow was not initiated by the app\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/sync/git/providers/github.ts","lineNumber":297,"sourceCode":"        authUrl: url.toString(),\n        state,\n      };\n    } catch (error) {\n      const errorMessage = error instanceof Error ? error.message : String(error);\n      console.error('Failed to initiate the GitHub OAuth flow:', error);\n      throw new Error(`Failed to initiate the GitHub OAuth flow: ${errorMessage}`);\n    }\n  }\n\n  /**\n   * Complete OAuth flow\n   * Exchanges code for token and creates/updates credential in database\n   */\n  async completeOAuth(code: string, state: string): Promise<OAuthCompleteResult> {\n    try {\n      // Validate state for security (CSRF protection)\n      if (!PLAYWRIGHT_TEST && !githubStatesCache.has(state)) {\n        throw new Error('Invalid state parameter. It looks like the authorization flow was not initiated by the app.');\n      }\n      const reauthorizingCredentialId = githubStatesCache.get(state);\n\n      // Exchange code for access token via Insomnia backend\n      const response = await net.fetch(getApiBaseURL() + '/v1/oauth/github-app', {\n        method: 'POST',\n        body: JSON.stringify({\n          code,\n        }),\n        headers: {\n          'Content-Type': 'application/json',\n        },\n      });\n\n      if (!response.ok) {\n        throw new Error(`Failed to exchange code for token: ${response.statusText}`);\n      }\n","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/sync/git/providers/github.ts#L279-L315","documentation":"CSRF guard in GitHubProvider.completeOAuth: the state parameter returned by the OAuth callback is not present in the in-memory githubStatesCache, meaning the callback was not initiated by this app instance (or the app restarted), so the code exchange is refused.","triggerScenarios":"Thrown at packages/insomnia/src/sync/git/providers/github.ts:297 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the GitHub OAuth flow from the app so a fresh state is issued","Avoid app restarts between initiating and completing the flow"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","contentChangedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}