{"record":{"id":"eaac7daeea2bf1bf","repo":"zed-industries/zed","slug":"missing-state-parameter-in-oauth-callback","errorCode":null,"errorMessage":"missing 'state' parameter in OAuth callback","messagePattern":"missing 'state' parameter in OAuth callback","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/oauth_callback_server/src/oauth_callback_server.rs","lineNumber":215,"sourceCode":"                        if !value.is_empty() {\n                            error_description = Some(value.into_owned());\n                        }\n                    }\n                    _ => {}\n                }\n            }\n\n            if let Some(error_code) = error {\n                anyhow::bail!(\n                    \"OAuth authorization failed: {} ({})\",\n                    error_code,\n                    error_description.as_deref().unwrap_or(\"no description\")\n                );\n            }\n\n            let code = code.ok_or_else(|| anyhow!(\"missing 'code' parameter in OAuth callback\"))?;\n            let state =\n                state.ok_or_else(|| anyhow!(\"missing 'state' parameter in OAuth callback\"))?;\n\n            Ok(Self { code, state })\n        }\n    }\n\n    /// How long to wait for the browser to complete the OAuth flow before giving\n    /// up and releasing the loopback port.\n    const OAUTH_CALLBACK_TIMEOUT: Duration = Duration::from_secs(2 * 60);\n\n    /// Start a loopback HTTP server to receive the OAuth authorization callback.\n    ///\n    /// Binds to an ephemeral loopback port. Returns `(redirect_uri, callback_future)`.\n    /// The caller should use the redirect URI in the authorization request, open\n    /// the browser, then await the future to receive the callback.\n    pub fn start_oauth_callback_server() -> Result<(\n        String,\n        futures::channel::oneshot::Receiver<Result<OAuthCallbackParams>>,\n    )> {","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/zed-industries/zed/blob/f4178619acd0d47ea1f76a2025c42962c6d6638c/crates/oauth_callback_server/src/oauth_callback_server.rs#L197-L233","documentation":"Parse guard in OAuthCallbackParams::parse_query: the callback request lacked a `state` parameter, so the response cannot be matched to the pending sign-in attempt (CSRF/session correlation fails) and it is rejected.","triggerScenarios":"Thrown at crates/oauth_callback_server/src/oauth_callback_server.rs:215 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the OAuth sign-in flow so a fresh state is issued","Check that the authorization URL included the state parameter and the provider echoes it back"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f4178619acd0d47ea1f76a2025c42962c6d6638c","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}