{"record":{"id":"b35b69c946e5d06a","repo":"multica-ai/multica","slug":"composio-state-malformed","errorCode":null,"errorMessage":"composio: state malformed","messagePattern":"composio: state malformed","errorType":"http","errorClass":"ErrStateMalformed","httpStatus":302,"severity":"error","filePath":"server/internal/integrations/composio/state.go","lineNumber":19,"sourceCode":"package composio\n\nimport (\n\t\"crypto/hmac\"\n\t\"crypto/sha256\"\n\t\"encoding/base64\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"strings\"\n\t\"time\"\n)\n\n// Signed-state errors. The handler maps all of them to a generic\n// \"connect failed\" redirect so a tampered/expired state never leaks which\n// check failed.\nvar (\n\t// ErrStateMalformed is returned when the state token is not the expected\n\t// \"<payload>.<sig>\" base64url shape.\n\tErrStateMalformed = errors.New(\"composio: state malformed\")\n\t// ErrStateSignature is returned when the HMAC signature does not match —\n\t// the state was tampered with or signed by a different secret.\n\tErrStateSignature = errors.New(\"composio: state signature mismatch\")\n\t// ErrStateExpired is returned when the state's exp claim is in the past.\n\tErrStateExpired = errors.New(\"composio: state expired\")\n)\n\n// stateClaims is the payload embedded in the signed connect-state. It carries\n// exactly what CompleteCallback needs to attribute the callback to a user and\n// toolkit without a server-side session table — the signature is what makes it\n// trustworthy, the short exp is what bounds replay.\n//\n// Field names are single letters to keep the encoded token compact; they are\n// an internal wire format, never exposed to clients.\ntype stateClaims struct {\n\tUserID      string `json:\"u\"`\n\tToolkitSlug string `json:\"t\"`\n\t// AuthConfigID is the exact Composio auth_config_id resolved at BeginConnect","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/integrations/composio/state.go#L1-L37","documentation":"Error \"composio: state malformed\" thrown in multica-ai/multica.","triggerScenarios":"Thrown at server/internal/integrations/composio/state.go:19 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the OAuth flow; the state parameter could not be decoded."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}