{"record":{"id":"e0019cdbc81c2f7d","repo":"xai-org/grok-build","slug":"server-returned-invalid-user-code-format-expected","errorCode":null,"errorMessage":"Server returned invalid user_code format (expected [A-Z0-9-])","messagePattern":"Server returned invalid user_code format \\(expected \\[A-Z0-9-\\]\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/device_code.rs","lineNumber":177,"sourceCode":"\n    if !resp.status().is_success() {\n        let status = resp.status();\n        let body = resp.text().await.unwrap_or_default();\n        if status.as_u16() == 404 {\n            anyhow::bail!(DeviceCodeError::NotEnabled);\n        }\n        anyhow::bail!(\"Device code request failed (HTTP {status}): {body}\");\n    }\n\n    let server_resp: DeviceCodeResponse = resp.json().await?;\n\n    // Defend against control characters from a malicious issuer.\n    if !server_resp\n        .user_code\n        .chars()\n        .all(|c| c.is_ascii_alphanumeric() || c == '-')\n    {\n        anyhow::bail!(\"Server returned invalid user_code format (expected [A-Z0-9-])\");\n    }\n\n    validate_verification_uri(&server_resp.verification_uri)?;\n    if let Some(ref verification_uri_complete) = server_resp.verification_uri_complete {\n        validate_verification_uri(verification_uri_complete)?;\n    }\n\n    Ok(DeviceCode {\n        verification_uri: server_resp.verification_uri,\n        verification_uri_complete: server_resp.verification_uri_complete,\n        user_code: server_resp.user_code,\n        device_code: server_resp.device_code,\n        interval: server_resp\n            .interval\n            .unwrap_or(DEFAULT_DEVICE_POLL_INTERVAL_SECS),\n        expires_in: server_resp.expires_in,\n    })\n}","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/device_code.rs#L159-L195","documentation":"During OAuth2 device-authorization, the server's user_code is validated to contain only ASCII alphanumerics and hyphens before it is shown to the user. If the issuer returns a user_code with other characters (spaces, control chars, unicode), the client refuses to display it, defending against spoofing/injection from a malicious or buggy issuer.","triggerScenarios":"request_device_code receives a device-authorization response whose user_code field contains any character outside [A-Za-z0-9-] (e.g. 'ABCD EFGH', 'ab12_cd', or strings with control characters).","commonSituations":"Pointing the client at a non-xAI/proxied authorization server with a different user_code alphabet; a server-side regression changing the code format; a misconfigured base URL hitting an unintended endpoint that returns HTML or a different payload shape.","solutions":["Check which authorization server you are hitting (XAI_API_BASE / base URL config) and ensure it is the genuine xAI OAuth2 issuer.","Inspect the raw device-authorization response (curl -X POST <auth endpoint>/device/code) to see the actual user_code format.","Update the xai-grok client to a version matching the server's current user_code format.","If running your own proxy, make it pass through the issuer's user_code unchanged and conform to the expected alphabet."],"exampleFix":"// server/proxy returning spaced user_code\n{\"user_code\": \"WDJB MJJT\"}\n// after: normalize to the expected alphabet\n{\"user_code\": \"WDJB-MJJT\"}","handlingStrategy":"validation","validationCode":"fn user_code_ok(code: &str) -> bool {\n    !code.is_empty()\n        && code.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')\n}\n// call before displaying: if !user_code_ok(&resp.user_code) { abort }","typeGuard":"fn is_safe_user_code(s: &str) -> Option<&str> {\n    let ok = s.chars().all(|c| c.is_ascii_alphanumeric() || c == '-');\n    if ok { Some(s) } else { None }\n}","tryCatchPattern":"match request_device_code(&client, &cfg).await {\n    Ok(resp) => display(resp),\n    Err(e) if e.to_string().contains(\"invalid user_code\") => {\n        eprintln!(\"Issuer returned unusable user_code; verify the auth server URL.\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Pin the authorization server to the official xAI issuer URL.","When proxying the device endpoint, pass through user_code untouched.","Add a response-shape test against your issuer before deploying client updates.","Log the raw device-authorization response on failure for diagnosis."],"tags":["oauth","device-flow","input-validation"],"backgroundTag":"invalid-server-response-format","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}