decolua/9router · info

Not found

Error message

Not found

What it means

startLocalServer spins up a temporary HTTP server whose only job is to receive the OAuth redirect and hand query params to onCallback. Any request whose path is not the registered callback path gets a 404 'Not found' response. This means the browser (or anything else) hit the loopback listener on the wrong URL — the server is alive but this request is not the OAuth callback.

Source

Thrown at src/lib/oauth/utils/server.js:73

    const timer = setInterval(() => {
      count--;
      countdown.textContent = count;
      if (count <= 0) {
        clearInterval(timer);
        window.close();
        setTimeout(() => {
          message.textContent = "Please close this tab manually.";
        }, 500);
      }
    }, 1000);
  </script>
</body>
</html>`);

        // Call callback with params
        onCallback(params);
      } else {
        res.writeHead(404);
        res.end("Not found");
      }
    });

    // Listen on fixed port or find available port
    const portToUse = fixedPort || 0;
    server.listen(portToUse, "127.0.0.1", () => {
      const { port } = server.address();
      resolve({
        server,
        port,
        close: () => server.close(),
      });
    });

    server.on("error", (err) => {
      if (err.code === "EADDRINUSE" && fixedPort) {
        reject(new Error(`Port ${fixedPort} is already in use. Please close other applications using this port.`));

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Compare the redirect_uri registered with the OAuth provider against the callback path startLocalServer listens on; make them identical.
2. Re-run the login flow from the app instead of typing the URL manually — the 404 for stray requests can be ignored.
3. If a probe/monitor keeps hitting the port, point it elsewhere or pick another fixed port so the callback listener is reserved.

Example fix

// before (provider console)
redirect_uri = http://127.0.0.1:1455/auth/complete
// after
redirect_uri = http://127.0.0.1:1455/callback  // matches the path the local server serves

const expected = new URL(callbackUrl).pathname;
const redirectUri = new URL(providerRedirectUri);
if (redirectUri.hostname !== '127.0.0.1' || redirectUri.pathname !== expected) {
  throw new Error(`redirect_uri ${providerRedirectUri} does not match local callback ${callbackUrl}`);
}

function isLoopbackCallback(u) { try { const url = new URL(u); return ['127.0.0.1','localhost','[::1]'].includes(url.hostname); } catch { return false; } }

try { await startLocalServer({ port, close }); }
catch (e) {
  if (e.message === 'Not found' || e.status === 404) console.warn('Non-callback request hit local OAuth listener — check redirect_uri path');
  else throw e;
}

When it happens

Trigger: Browser hits http://127.0.0.1:<port>/<anything-other-than-callback-path> while the local OAuth listener is running: stray navigation, favicon request, security scanner, or a provider configured to redirect to a different path than the one this server accepts.

Common situations: OAuth provider's redirect_uri path was edited in the provider console but not in the app config (or vice versa); user manually navigating to the port; preflight/health probes hitting the callback port; port reuse from a previous session where another app expected a different path.

Related errors

• Failed to save tokens
• Failed to save tokens
• Failed to save tokens
• Kiro tool input must be a JSON object
• Vertex OAuth/ADC requires a project_id. Add quota_project_id

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/b266e64e433d07fc. Report an issue: GitHub.