{"record":{"id":"faf977b93fe9de83","repo":"Hmbown/CodeWhale","slug":"xai-oidc-discovery-returned-field-on-a-different","errorCode":null,"errorMessage":"xAI OIDC discovery returned {field} on a different origin than the issuer","messagePattern":"xAI OIDC discovery returned (.+?) on a different origin than the issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1091,"sourceCode":"    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"xAI OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"xAI OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"xAI OIDC discovery returned unsupported {field} scheme\");\n    }\n    let issuer = reqwest::Url::parse(issuer).context(\"xAI OIDC issuer is not a valid URL\")?;\n    if issuer.scheme() == \"https\" && parsed.scheme() != \"https\" {\n        bail!(\"xAI OIDC discovery attempted to downgrade {field} from HTTPS\");\n    }\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        bail!(\"xAI OIDC discovery returned credentials in {field}\");\n    }\n    if parsed.origin() != issuer.origin() {\n        bail!(\"xAI OIDC discovery returned {field} on a different origin than the issuer\");\n    }\n    Ok(endpoint.to_string())\n}\n\nfn parse_oauth_json_response<T: DeserializeOwned>(\n    response: reqwest::blocking::Response,\n    operation: &str,\n) -> Result<(reqwest::StatusCode, T)> {\n    let status = response.status();\n    let content_type = response\n        .headers()\n        .get(reqwest::header::CONTENT_TYPE)\n        .and_then(|value| value.to_str().ok())\n        .unwrap_or(\"missing\")\n        .to_string();\n    let mut reader = response.take(OAUTH_RESPONSE_BODY_LIMIT + 1);\n    let mut body = Vec::new();\n    reader","sourceCodeStart":1073,"sourceCodeEnd":1109,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1073-L1109","documentation":"Origin-binding guard in validate_discovered_oauth_endpoint: an endpoint returned by xAI's OIDC discovery must live on the same origin (scheme, host, and port) as the configured issuer. A {field} pointing at a different origin would send OAuth codes and tokens to an unrelated host, which is the classic malicious-discovery pattern, so the document is rejected.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1091 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the configured issuer origin matches where xAI actually hosts its OAuth endpoints","Check DNS/proxy configuration for responses redirected to another origin","Retry the login flow to rule out a transient misresponse","Report the cross-origin endpoint to xAI; use XAI_API_KEY in the meantime"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}