{"record":{"id":"b43a5157fcac9fac","repo":"juanfont/headscale","slug":"invalid-code","errorCode":null,"errorMessage":"invalid code","messagePattern":"invalid code","errorType":"http","errorClass":"HTTPError","httpStatus":403,"severity":"error","filePath":"hscontrol/oidc.go","lineNumber":485,"sourceCode":"\tcode string,\n\tstate string,\n) (*oauth2.Token, error) {\n\tvar exchangeOpts []oauth2.AuthCodeOption\n\n\tif a.cfg.PKCE.Enabled {\n\t\tregInfo, ok := a.authCache.Get(state)\n\t\tif !ok {\n\t\t\treturn nil, NewHTTPError(http.StatusNotFound, \"registration not found\", errNoOIDCRegistrationInfo)\n\t\t}\n\n\t\tif regInfo.Verifier != nil {\n\t\t\texchangeOpts = []oauth2.AuthCodeOption{oauth2.VerifierOption(*regInfo.Verifier)}\n\t\t}\n\t}\n\n\toauth2Token, err := a.oauth2Config.Exchange(ctx, code, exchangeOpts...)\n\tif err != nil {\n\t\treturn nil, NewHTTPError(http.StatusForbidden, \"invalid code\", fmt.Errorf(\"exchanging code for token: %w\", err))\n\t}\n\n\treturn oauth2Token, nil\n}\n\n// extractIDToken extracts the ID token from the oauth2 token.\nfunc (a *AuthProviderOIDC) extractIDToken(\n\tctx context.Context,\n\toauth2Token *oauth2.Token,\n) (*oidc.IDToken, error) {\n\trawIDToken, ok := oauth2Token.Extra(\"id_token\").(string)\n\tif !ok {\n\t\treturn nil, NewHTTPError(http.StatusBadRequest, \"no id_token\", errNoOIDCIDToken)\n\t}\n\n\tverifier := a.oidcProvider.Verifier(&oidc.Config{ClientID: a.cfg.ClientID})\n\n\tidToken, err := verifier.Verify(ctx, rawIDToken)","sourceCodeStart":467,"sourceCodeEnd":503,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/oidc.go#L467-L503","documentation":"Error \"invalid code\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/oidc.go:485 when the library encounters an invalid state.","commonSituations":"The OIDC authorization code is invalid, expired, or already exchanged. Restart the login flow to obtain a fresh code.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (invalid code); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (invalid code); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}