{"record":{"id":"c9ff7d6c86bf6e2d","repo":"vxcontrol/pentagi","slug":"auth-invalidlogincallbackrequest","errorCode":"Auth.InvalidLoginCallbackRequest","errorMessage":"code is required","messagePattern":"code is required","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"backend/pkg/server/services/auth.go","lineNumber":343,"sourceCode":"\t\thttp.StatusTemporaryRedirect)\n}\n\n// AuthLoginGetCallback is function to catch login callback from OAuth application with code only\n// @Summary Login user from external OAuth application\n// @Tags Public\n// @Accept json\n// @Produce json\n// @Param code query string false \"Auth code from OAuth provider to exchange token\"\n// @Success 303 \"redirect to registered return_uri path in the state\"\n// @Failure 400 {object} response.errorResp \"invalid login data\"\n// @Failure 401 {object} response.errorResp \"invalid login or password\"\n// @Failure 403 {object} response.errorResp \"login not permitted\"\n// @Failure 500 {object} response.errorResp \"internal error on login\"\n// @Router /auth/login-callback [get]\nfunc (s *AuthService) AuthLoginGetCallback(c *gin.Context) {\n\tcode := c.Query(\"code\")\n\tif code == \"\" {\n\t\tresponse.Error(c, response.ErrAuthInvalidLoginCallbackRequest, fmt.Errorf(\"code is required\"))\n\t\treturn\n\t}\n\n\tstate, err := c.Request.Cookie(s.stateCookieName())\n\tif err != nil {\n\t\tlogger.FromContext(c).WithError(err).Errorf(\"error getting state from cookie\")\n\t\tresponse.Error(c, response.ErrAuthInvalidAuthorizationState, err)\n\t\treturn\n\t}\n\n\tqueryState := c.Query(\"state\")\n\tif queryState == \"\" {\n\t\tlogger.FromContext(c).Errorf(\"error missing state parameter in OAuth callback\")\n\t\tresponse.Error(c, response.ErrAuthInvalidAuthorizationState, fmt.Errorf(\"state parameter is required\"))\n\t\treturn\n\t}\n\n\tif queryState != state.Value {","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/services/auth.go#L325-L361","documentation":"Auth.InvalidLoginCallbackRequest is returned by AuthLoginGetCallback when the OAuth2 login callback request arrives without the mandatory 'code' query parameter. The code is the authorization code the identity provider redirects back with; without it the server cannot proceed with the token exchange. The handler rejects the request immediately before touching cookies or state.","triggerScenarios":"GET /auth/login-callback (or POST variant invoking the same flow) with no ?code= query parameter, e.g. a user bookmarking the callback URL, an IdP redirect that dropped the code, or a manually crafted request.","commonSituations":"Users re-opening a stale callback URL after the OAuth redirect expired; misconfigured IdP redirect URIs that hit the endpoint without completing authorization; health checks or crawlers scraping the callback path; frontends calling the callback directly instead of following the IdP redirect.","solutions":["Ensure the OAuth2 authorize URL's redirect_uri points users to /auth/login-callback and that the IdP appends ?code=... on redirect","Initiate login via the proper /auth/login endpoint so the OAuth flow (and code) is generated","Check the IdP provider configuration (response_type=code) and that the client is not in a broken/partial auth state","Retry the login from the UI instead of reloading the callback URL"],"exampleFix":"// before\nwindow.location = '/auth/login-callback'\n// after\nconst res = await fetch('/auth/login') // server redirects to IdP, which redirects back with ?code=...","handlingStrategy":"validation","validationCode":"const url = new URL(window.location.href)\nif (!url.searchParams.get('code')) {\n  // redirect to /auth/login to restart the flow\n}","typeGuard":"function hasOAuthCode(url: URL): url is URL & { searchParams: URLSearchParams } {\n  return typeof url.searchParams.get('code') === 'string' && url.searchParams.get('code') !== ''\n}","tryCatchPattern":null,"preventionTips":["Never bookmark or reuse callback URLs","Always start OAuth via the /auth/login entry point","Verify redirect_uri config in the IdP matches exactly","Monitor for crawlers hitting the callback path"],"tags":["oauth2","auth","missing-parameter"],"backgroundTag":"oauth2-callback-missing-code","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}