{"record":{"id":"cef70fe639438b4d","repo":"earendil-works/pi","slug":"untrusted-verification-uri-in-xai-oauth-response","errorCode":null,"errorMessage":"Untrusted verification URI in xAI OAuth response","messagePattern":"Untrusted verification URI in xAI OAuth response","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/ai/src/auth/oauth/xai.ts","lineNumber":56,"sourceCode":"\treturn value;\n}\n\nfunction positiveNumber(body: JsonObject, field: string): number {\n\tconst value = body[field];\n\tif (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n\t\tthrow new Error(`Invalid xAI OAuth response field: ${field}`);\n\t}\n\treturn value;\n}\n\n// The verification URI is opened in the user's browser; force it to be an https URL\n// so a malicious response cannot make `open` launch something else.\nfunction validateVerificationUri(raw: string): string {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(raw);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\tif (url.protocol !== \"https:\") {\n\t\tthrow new Error(\"Untrusted verification URI in xAI OAuth response\");\n\t}\n\treturn url.href;\n}\n\nasync function postForm(url: string, fields: Record<string, string>, signal: AbortSignal): Promise<OAuthHttpResponse> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams(fields),\n\t\t\tsignal,","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/earendil-works/pi/blob/4af9d21d3b4d664e4a29fcabfec85171077248e3/packages/ai/src/auth/oauth/xai.ts#L38-L74","documentation":"Error \"Untrusted verification URI in xAI OAuth response\" thrown in earendil-works/pi.","triggerScenarios":"Thrown at packages/ai/src/auth/oauth/xai.ts:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Abort the login; the verification URI is untrusted, so check for a MITM or misconfigured proxy."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4af9d21d3b4d664e4a29fcabfec85171077248e3","analyzedAt":"2026-08-24T13:07:14.692Z","schemaVersion":2},"datasetVersion":"2026-08-24T17:17:21.512Z"}