{"record":{"id":"e81f7155abddab11","repo":"theonedev/onedev","slug":"invalid-state-response","errorCode":null,"errorMessage":"Invalid state response","messagePattern":"Invalid state response","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-sso-discord/src/main/java/io/onedev/server/plugin/sso/discord/DiscordConnector.java","lineNumber":92,"sourceCode":"\t\tDiscordAuthorizationCodeResponse codeResponse = new DiscordAuthorizationCodeResponse(request.getQueryString());\n\t\t\n\t\tif (codeResponse.hasValidCode()) {\n\t\t\tRequest apiRequest = getCachedApiRequest();\n\t\t\t\n\t\t\tif (codeResponse.hasState(apiRequest.getState())) {\n\t\t\t\ttry {\n\t\t\t\t\tAccessTokenResponse accessTokenResponse = apiRequest.getToken(getClientSecret(), codeResponse.getCode());\n\t\t\t\t\t\n\t\t\t\t\tif (accessTokenResponse.isOK() && accessTokenResponse.hasValidAccessToken()) {\n\t\t\t\t\t\treturn processTokenResponse(accessTokenResponse);\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tthrow new AuthenticationException(accessTokenResponse.getContent());\n\t\t\t\t} catch (IOException e) {\n\t\t\t\t\tthrow new RuntimeException(e);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tthrow new AuthenticationException(_T(\"Invalid state response\"));\n\t\t\t}\n\t\t} else {\n\t\t\tthrow new AuthenticationException(codeResponse.getError());\n\t\t}\n\t}\n\n\t@Override\n\tpublic String buildAuthUrl(String providerName) {\n\t\tRequest apiRequest = new Request(getClientId(), getScopes(), getCallbackUri(providerName).toString());\n\t\tSession.get().setAttribute(SESSION_ATTR_API_REQUEST, apiRequest);\n\t\t\n\t\tString authURI = apiRequest.getAuthorizationURI();\n\t\treturn authURI;\n\t}\n\t\n\tprivate SsoAuthenticated processTokenResponse(AccessTokenResponse accessTokenResponse) {\n\t\ttry {\n\t\t\tfinal boolean bCheckGuilds = !StringUtils.isEmpty(getServerId());","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-sso-discord/src/main/java/io/onedev/server/plugin/sso/discord/DiscordConnector.java#L74-L110","documentation":"Thrown by DiscordConnector.handleAuthResponse when Discord redirects back to the SSO callback without a 'code' parameter but also without a recognizable error, meaning the OAuth2 'state' check cannot be completed. The connector treats any callback whose state does not match what it originally sent as an unsolicited or forged response and rejects authentication.","triggerScenarios":"Discord's authorization endpoint returns to the callback URL and the connector's expected session state is absent/mismatched while parsing the code response; typically a callback arriving outside the original login flow (e.g. after session loss or replaying an old callback URL).","commonSituations":"User opens the callback URL directly or refreshes it after the Wicket session expired; reverse proxy strips query parameters; user has two SSO tabs open and states overwrite each other; browser blocked session cookies.","solutions":["Restart the SSO login flow from the beginning (click the Discord sign-in button again) instead of reusing/reloading the callback URL.","Ensure browser cookies for the OneDev server are enabled so the Wicket session (holding the state) survives the redirect.","Verify no proxy/CDN is stripping query parameters (state/code) from the callback URL.","Avoid running multiple concurrent SSO logins in the same browser session."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    connector.handleAuthResponse(...);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"Invalid state response\")) {\n        // restart SSO flow: redirect user to sign-in again\n    }\n}","preventionTips":["Enable session cookies in browsers used for SSO.","Don't reload or bookmark OAuth callback URLs.","Avoid parallel SSO logins in one browser session.","Check proxies preserve query parameters."],"tags":["oauth","sso","state-mismatch","discord"],"backgroundTag":"oauth-state-mismatch","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}