{"record":{"id":"c4a4626e7ea7fc0d","repo":"Tencent/WeKnora","slug":"failed-to-generate-pkce-verifier-w","errorCode":null,"errorMessage":"failed to generate PKCE verifier: %w","messagePattern":"failed to generate PKCE verifier: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/mcp/oauth_manager.go","lineNumber":124,"sourceCode":"\t\t\treturn \"\", \"\", fmt.Errorf(\"dynamic client registration failed: %w\", err)\n\t\t}\n\t\tclientID := h.GetClientID()\n\t\tif clientID == \"\" {\n\t\t\treturn \"\", \"\", fmt.Errorf(\"dynamic client registration returned an empty client_id\")\n\t\t}\n\t\tif err := m.repo.SaveClient(ctx, &types.MCPOAuthClient{\n\t\t\tTenantID:    tenantID,\n\t\t\tServiceID:   service.ID,\n\t\t\tClientID:    clientID,\n\t\t\tRedirectURI: redirectURI,\n\t\t}); err != nil {\n\t\t\tlogger.GetLogger(ctx).Warnf(\"failed to persist MCP oauth client: %v\", err)\n\t\t}\n\t}\n\n\tverifier, err := transport.GenerateCodeVerifier()\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to generate PKCE verifier: %w\", err)\n\t}\n\tchallenge := transport.GenerateCodeChallenge(verifier)\n\tstate, err := transport.GenerateState()\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to generate state: %w\", err)\n\t}\n\n\tauthURL, err := h.GetAuthorizationURL(ctx, state, challenge)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to build authorization URL: %w\", err)\n\t}\n\n\tif err := m.states.Put(ctx, state, OAuthState{\n\t\tTenantID:         tenantID,\n\t\tUserID:           principal.StorageID(),\n\t\tPrincipal:        principal,\n\t\tServiceID:        service.ID,\n\t\tCodeVerifier:     verifier,","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/mcp/oauth_manager.go#L106-L142","documentation":"Wraps a failure from transport.GenerateCodeVerifier when creating the PKCE code verifier for the authorization-code flow. PKCE is mandatory in this flow, so a verifier-generation failure aborts StartAuthorization before any URL is produced. Typically caused by the underlying secure randomness source failing.","triggerScenarios":"transport.GenerateCodeVerifier returns an error — usually crypto/rand read failure, entropy exhaustion, or an OS-level RNG error — when building the authorize request.","commonSituations":"Container/host with depleted entropy (rare on modern Linux); seccomp/AppArmor policy blocking getrandom(2); running on constrained hardware; instrumented crypto/rand stub in tests returning errors.","solutions":["Verify crypto/rand works on the host (check dmesg/seccomp denials for getrandom)","Fix container/sandbox security policies that block the random source","Retry the authorization start; RNG failures are typically transient","Ensure the runtime is not using a stubbed or restricted crypto provider"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// smoke-test crypto/rand availability at startup\nif _, err := crypto_rand.Read(make([]byte, 32)); err != nil {\n    log.Fatalf(\"crypto/rand unavailable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"_, _, err := mgr.StartAuthorizationForService(ctx, svc, tenantID, principal, redirect, \"\")\nif err != nil && strings.Contains(err.Error(), \"PKCE verifier\") {\n    // RNG failure is typically transient: retry once, then surface as infra error\n    if _, _, retryErr := mgr.StartAuthorizationForService(ctx, svc, tenantID, principal, redirect, \"\"); retryErr != nil {\n        return fmt.Errorf(\"secure RNG unavailable on host: %w\", retryErr)\n    }\n    return nil\n}\nif err != nil { return err }","preventionTips":["Add a startup health check that reads from crypto/rand","Avoid seccomp/AppArmor rules that block getrandom(2) in containers","Do not stub crypto/rand in production builds","Monitor entropy-related kernel logs on constrained hosts"],"tags":["oauth","pkce","crypto","randomness"],"backgroundTag":"pkce-verifier-generation-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}