{"record":{"id":"eda1c9eaffa47a93","repo":"juanfont/headscale","slug":"invalid-auth-id","errorCode":null,"errorMessage":"invalid auth id","messagePattern":"invalid auth id","errorType":"http","errorClass":"HTTPError","httpStatus":400,"severity":"warning","filePath":"hscontrol/handlers.go","lineNumber":341,"sourceCode":"\t}\n\n\twriter.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n\twriter.WriteHeader(http.StatusOK)\n\n\t_, err = writer.Write([]byte(templates.AuthWeb(\n\t\t\"Authentication check\",\n\t\t\"Run the command below in the headscale server to approve this authentication request:\",\n\t\t\"headscale auth approve --auth-id \"+authID.String(),\n\t).Render()))\n\tif err != nil {\n\t\tlog.Error().Err(err).Msg(\"failed to write auth response\")\n\t}\n}\n\nfunc authIDFromRequest(req *http.Request) (types.AuthID, error) {\n\traw, err := stringParam(req, \"auth_id\")\n\tif err != nil {\n\t\treturn \"\", NewHTTPError(http.StatusBadRequest, \"invalid auth id\", fmt.Errorf(\"parsing auth_id from URL: %w\", err))\n\t}\n\n\t// We need to make sure we dont open for XSS style injections, if the parameter that\n\t// is passed as a key is not parsable/validated as a NodePublic key, then fail to render\n\t// the template and log an error.\n\tauthId, err := types.AuthIDFromString(raw)\n\tif err != nil {\n\t\treturn \"\", NewHTTPError(http.StatusBadRequest, \"invalid auth id\", fmt.Errorf(\"parsing auth_id from URL: %w\", err))\n\t}\n\n\treturn authId, nil\n}\n\n// RegisterHandler shows a simple message in the browser to point to the CLI\n// Listens in /register/:registration_id.\n//\n// This is not part of the Tailscale control API, as we could send whatever URL\n// in the [tailcfg.RegisterResponse.AuthURL] field.","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/handlers.go#L323-L359","documentation":"Thrown by authIDFromRequest when the auth_id URL parameter cannot be retrieved (stringParam fails, i.e. it is absent from the chi route context). This handler backs browser-based registration/SSH check flows where the auth_id links the browser session to a pending control-plane auth cache entry.","triggerScenarios":"A request to /register/ or /machine/ssh/action/ routed without the auth_id route parameter, or a hand-built URL that drops the query parameter.","commonSituations":"User manually truncates or retypes the registration URL from the CLI output; a template or redirect drops the auth_id parameter; route misconfiguration.","solutions":["Re-copy the full URL emitted by 'headscale auth' or the SSH check flow, including auth_id","Check templates/redirects that construct these URLs for parameter loss","If it persists, verify the chi route pattern includes the expected parameter name"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if strings.TrimSpace(authIDRaw) == \"\" {\n    return errors.New(\"auth_id parameter is missing from URL\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass server-issued URLs through verbatim","When building these URLs programmatically, assert every required parameter is set before rendering"],"tags":["auth","http","url-parameter","registration"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}