Authorization failed: missing code.
',\n );\n return;\n }\n\n if (!state) {\n res\n .status(400)\n .send(\n 'Authorization failed: missing state parameter.
',\n );\n return;\n }\n\n try {\n const session = await enableBankingService.createSession(code);\n debug(\n 'Callback session created: %s with %d accounts',\n session.session_id,\n session.accounts.length,\n );\n\n const result = await buildSessionResult(session, extractPsuHeaders(req));\n\n // Always cache the result so retries within TTL can read it\n completedAuths.set(state, result);","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/actualbudget/actual/blob/d4334cb6e6123f4d3bcea1ad6166608884c7e658/packages/sync-server/src/app-enablebanking/app-enablebanking.ts#L98-L134","documentation":"The Enable Banking OAuth callback requires a `state` query parameter to correlate the redirect with a pending authorization session. When `state` is absent the handler returns HTTP 400 with this HTML page. The state parameter is the CSRF/session correlation token for the pending auth, so the flow cannot proceed without it.","triggerScenarios":"A request hits the Enable Banking callback route with a `code` but no `state` query parameter — typically a hand-crafted or replayed callback URL, or a provider that drops the state on redirect.","commonSituations":"Testing the callback URL manually in a browser; third-party tools that strip query parameters; misconfigured authorization request that omitted state from the outbound URL while the callback still expects it.","solutions":["Restart the authorization flow so a fresh state is generated and echoed back by the provider","Ensure the outbound authorization request includes a state parameter","Do not invoke the callback URL directly; always complete the provider-hosted authorization step","Check for middleware/proxies that may strip query parameters from the redirect"],"exampleFix":"// before\nGET /enablebanking-handler?code=abc -> 400 missing state\n// after\nGET /enablebanking-handler?code=abc&state=