{"record":{"id":"9b18bd82ff5376f6","repo":"hashicorp/nomad","slug":"missing-code","errorCode":null,"errorMessage":"missing code","messagePattern":"missing code","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2390,"sourceCode":"}\n\n// Validate ensures the request object contains all the required fields in\n// order to complete the OIDC authentication flow.\nfunc (a *ACLOIDCCompleteAuthRequest) Validate() error {\n\n\tvar mErr multierror.Error\n\n\tif a.AuthMethodName == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing auth method name\"))\n\t}\n\tif a.ClientNonce == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing client nonce\"))\n\t}\n\tif a.State == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing state\"))\n\t}\n\tif a.Code == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing code\"))\n\t}\n\tif a.RedirectURI == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing redirect URI\"))\n\t}\n\treturn mErr.ErrorOrNil()\n}\n\n// ACLLoginResponse is the response when the auth flow has been\n// completed successfully.\ntype ACLLoginResponse struct {\n\tACLToken *ACLToken\n\tWriteMeta\n}\n\n// ACLLoginRequest is the request object to begin auth with an external\n// token provider.\ntype ACLLoginRequest struct {\n","sourceCodeStart":2372,"sourceCodeEnd":2408,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2372-L2408","documentation":"ACLOIDCCompleteAuthRequest.Validate requires Code to be non-empty. The authorization code returned by the OIDC provider is what Nomad exchanges (with the provider) for tokens to complete login. An empty Code yields 'missing code'.","triggerScenarios":"Calling the OIDC complete-auth endpoint with ACLOIDCCompleteAuthRequest.Code == \"\", e.g. the callback fired with an error response from the provider (no code parameter) but the client still submits the request.","commonSituations":"User denies consent at the IdP so no code is issued; provider redirect error handled by submitting the request anyway; callback URL parsing mistakes dropping the code parameter.","solutions":["Check the callback for an error parameter and abort if no code was issued","Parse the code query parameter correctly and set Code on the request","Handle provider error redirects (access_denied, etc.) with a user-facing message instead of calling the API"],"exampleFix":"// before\nq := r.URL.Query()\nreq := &structs.ACLOIDCCompleteAuthRequest{...}\n// after\nq := r.URL.Query()\nif q.Get(\"error\") != \"\" { return q.Get(\"error\") }\nreq := &structs.ACLOIDCCompleteAuthRequest{Code: q.Get(\"code\"), ...}","handlingStrategy":"validation","validationCode":"if req.Code == \"\" { return errors.New(\"Authorization code missing from callback; check for provider error response\") }","typeGuard":"func hasCode(req *structs.ACLOIDCCompleteAuthRequest) bool { return req != nil && req.Code != \"\" }","tryCatchPattern":"if err := req.Validate(); err != nil {\n  if strings.Contains(err.Error(), \"missing code\") { /* surface provider error to user instead of retrying */ }\n}","preventionTips":["Check callback error params (error, error_description) before submitting","Parse the code query parameter reliably in the callback handler","Abort the flow when the user denies consent at the provider"],"tags":["nomad","acl","oidc","validation","auth-code"],"backgroundTag":"missing-oauth-authorization-code","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}