{"record":{"id":"a982cd0f2fbf24d3","repo":"BookStackApp/BookStack","slug":"errors-social-no-action-defined","errorCode":null,"errorMessage":"errors.social_no_action_defined","messagePattern":"errors\\.social_no_action_defined","errorType":"exception","errorClass":"SocialSignInException","httpStatus":null,"severity":"error","filePath":"app/Access/Controllers/SocialController.php","lineNumber":63,"sourceCode":"    public function register(string $socialDriver)\n    {\n        $this->registrationService->ensureRegistrationAllowed();\n        session()->put('social-callback', 'register');\n\n        return $this->socialAuthService->startRegister($socialDriver);\n    }\n\n    /**\n     * The callback for social login services.\n     *\n     * @throws SocialSignInException\n     * @throws SocialDriverNotConfigured\n     * @throws UserRegistrationException\n     */\n    public function callback(Request $request, string $socialDriver)\n    {\n        if (!session()->has('social-callback')) {\n            throw new SocialSignInException(trans('errors.social_no_action_defined'), '/login');\n        }\n\n        // Check request for error information\n        if ($request->has('error') && $request->has('error_description')) {\n            throw new SocialSignInException(trans('errors.social_login_bad_response', [\n                'socialAccount' => $socialDriver,\n                'error'         => $request->input('error_description'),\n            ]), '/login');\n        }\n\n        $action = session()->pull('social-callback');\n\n        // Attempt login or fall-back to register if allowed.\n        $socialUser = $this->socialAuthService->getSocialUser($socialDriver);\n        if ($action === 'login') {\n            try {\n                return $this->socialAuthService->handleLoginCallback($socialDriver, $socialUser);\n            } catch (SocialSignInAccountNotUsed $exception) {","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Controllers/SocialController.php#L45-L81","documentation":"SocialSignInException thrown in SocialController::callback when the session has no 'social-callback' key. The callback endpoint is only meaningful in the middle of a social login flow; the session key records which action (login/register/attach) initiated it. Without it the code cannot know what to do with the OAuth response.","triggerScenarios":"Hitting /login/service/{driver}/callback (or equivalent social callback URL) directly, or when the session entry 'social-callback' was lost between the redirect to the provider and the return trip.","commonSituations":"User opens the callback URL from history/bookmark; cookies blocked or session expired while at the IdP consent screen; APP_URL mismatch causing session cookie domain change; load-balanced setup without shared session storage.","solutions":["Restart the social login from the beginning (visit /login/service/{driver} again) so the session flag is set","Verify APP_URL and session cookie settings so the session survives the redirect to/from the OAuth provider","Ensure Redis/database session storage is shared across all app servers in multi-server deployments","Check the browser is not blocking third-party cookies needed for the session"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!session()->has('social-callback')) {\n    return redirect('/login');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $result = $socialController->callback($request, $driver);\n} catch (\\BookStack\\Access\\Exceptions\\SocialSignInException $e) {\n    return redirect($e->redirect)->with('error', $e->getMessage());\n}","preventionTips":["Never share or bookmark social callback URLs","Use sticky/shared session storage in load-balanced setups","Keep APP_URL consistent so the session cookie persists across the OAuth round-trip"],"tags":["oauth","session","social-login"],"backgroundTag":"oauth-callback-state-missing","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}