{"record":{"id":"b266e64e433d07fc","repo":"decolua/9router","slug":"not-found","errorCode":null,"errorMessage":"Not found","messagePattern":"Not found","errorType":"http","errorClass":null,"httpStatus":404,"severity":"info","filePath":"src/lib/oauth/utils/server.js","lineNumber":73,"sourceCode":"    const timer = setInterval(() => {\n      count--;\n      countdown.textContent = count;\n      if (count <= 0) {\n        clearInterval(timer);\n        window.close();\n        setTimeout(() => {\n          message.textContent = \"Please close this tab manually.\";\n        }, 500);\n      }\n    }, 1000);\n  </script>\n</body>\n</html>`);\n\n        // Call callback with params\n        onCallback(params);\n      } else {\n        res.writeHead(404);\n        res.end(\"Not found\");\n      }\n    });\n\n    // Listen on fixed port or find available port\n    const portToUse = fixedPort || 0;\n    server.listen(portToUse, \"127.0.0.1\", () => {\n      const { port } = server.address();\n      resolve({\n        server,\n        port,\n        close: () => server.close(),\n      });\n    });\n\n    server.on(\"error\", (err) => {\n      if (err.code === \"EADDRINUSE\" && fixedPort) {\n        reject(new Error(`Port ${fixedPort} is already in use. Please close other applications using this port.`));","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/utils/server.js#L55-L91","documentation":"startLocalServer spins up a temporary HTTP server whose only job is to receive the OAuth redirect and hand query params to onCallback. Any request whose path is not the registered callback path gets a 404 'Not found' response. This means the browser (or anything else) hit the loopback listener on the wrong URL — the server is alive but this request is not the OAuth callback.","triggerScenarios":"Browser hits http://127.0.0.1:<port>/<anything-other-than-callback-path> while the local OAuth listener is running: stray navigation, favicon request, security scanner, or a provider configured to redirect to a different path than the one this server accepts.","commonSituations":"OAuth provider's redirect_uri path was edited in the provider console but not in the app config (or vice versa); user manually navigating to the port; preflight/health probes hitting the callback port; port reuse from a previous session where another app expected a different path.","solutions":["Compare the redirect_uri registered with the OAuth provider against the callback path startLocalServer listens on; make them identical.","Re-run the login flow from the app instead of typing the URL manually — the 404 for stray requests can be ignored.","If a probe/monitor keeps hitting the port, point it elsewhere or pick another fixed port so the callback listener is reserved."],"exampleFix":"// before (provider console)\nredirect_uri = http://127.0.0.1:1455/auth/complete\n// after\nredirect_uri = http://127.0.0.1:1455/callback  // matches the path the local server serves","handlingStrategy":"validation","validationCode":"const expected = new URL(callbackUrl).pathname;\nconst redirectUri = new URL(providerRedirectUri);\nif (redirectUri.hostname !== '127.0.0.1' || redirectUri.pathname !== expected) {\n  throw new Error(`redirect_uri ${providerRedirectUri} does not match local callback ${callbackUrl}`);\n}","typeGuard":"function isLoopbackCallback(u) { try { const url = new URL(u); return ['127.0.0.1','localhost','[::1]'].includes(url.hostname); } catch { return false; } }","tryCatchPattern":"try { await startLocalServer({ port, close }); }\ncatch (e) {\n  if (e.message === 'Not found' || e.status === 404) console.warn('Non-callback request hit local OAuth listener — check redirect_uri path');\n  else throw e;\n}","preventionTips":["Keep the provider's redirect_uri path identical to the path the local server listens on.","Never hand-edit or share the callback port URL; always start the flow from the app.","Reserve the OAuth callback port so unrelated services/probes don't answer on it.","Stray 404s on the listener are benign — check the redirect_uri only when the real login fails."],"tags":["http-404","oauth","local-server"],"backgroundTag":"oauth-callback-path-mismatch","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}