This request isn't valid. Please restart the Kimchi login fl

Error message

This request isn't valid. Please restart the Kimchi login flow.

What it means

Thrown by KimchiService._handleCallback() when the `state` query parameter is missing or does not equal the random state generated at startLogin(). State is the CSRF protection binding the callback to a specific in-flight session; a mismatch means the callback cannot be trusted to belong to this login attempt. The error instructs restarting the flow.

Source

Thrown at src/lib/oauth/services/kimchi.js:79

      s.done = true;
      s.resolved = r;
      clearTimeout(s.timeout);
      try { s.close(); } catch { /* already closed */ }
      setTimeout(() => sessions.delete(state), SESSION_TTL_MS).unref?.();
    });

    const callbackUrl = `http://127.0.0.1:${port}${KIMCHI_CONFIG.callbackPath}`;
    const authUrl = buildKimchiAuthUrl(callbackUrl, state);
    return { authUrl, port, state, result, close };
  }

  async _handleCallback(params, expectedState) {
    if (params.error) {
      throw new Error(params.error_description || params.error);
    }
    const candidate = params.state;
    if (!candidate || candidate !== expectedState) {
      throw new Error("This request isn't valid. Please restart the Kimchi login flow.");
    }
    const token = params.token;
    if (!token) {
      throw new Error("No token was returned by the Kimchi authentication server");
    }
    const check = await this.validateToken(token);
    if (!check.valid) {
      throw new Error(check.error || "Kimchi token validation failed");
    }
    return { token };
  }

  async fetchProfile(token) {
    try {
      const res = await fetch(KIMCHI_CONFIG.meUrl, {
        headers: { Authorization: `Bearer ${token}` },
      });
      if (!res.ok) return {};

View on GitHub (pinned to 90b52e06ff)

Solutions

Restart the login: run the Kimchi login command again and use only the freshly opened browser tab.
Close all older Kimchi auth tabs before starting a new flow.
Avoid running two Kimchi logins concurrently — finish or cancel one before the other.
If a tool/AV probes localhost ports, exclude 127.0.0.1 callback ports from scanning.

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

// Validate state before treating a callback as authentic
function hasValidState(params, expectedState) {
  return params != null && typeof params.state === "string" && params.state === expectedState;
}

Type guard

function isTrustedCallback(p, expected) {
  return typeof p === "object" && p !== null && typeof p.state === "string" && p.state === expected;
}

Try / catch

try {
  const outcome = await session.result;
  if (outcome.error === "This request isn't valid. Please restart the Kimchi login flow.") {
    console.error("State mismatch — a stale tab or foreign request hit the callback. Start a new login.");
  }
} catch { /* startLogin resolves errors into the result object */ }

Prevention

Use only the browser tab opened by the current login attempt; close all older auth tabs.
Never run concurrent Kimchi logins — each generates its own state and port.
Never hand-craft or replay callback URLs.
Note _handleCallback errors are resolved (not rejected) into the session result as { error } — check outcome.error.

When it happens

Trigger: A callback arrives at the local server whose `state` param differs from the expectedState captured in the closure — the user reloaded an old auth tab from a previous attempt, hit the callback URL manually, completed two concurrent logins whose callbacks crossed (old tab completing after the new session started), or a scanner/prefetch hit 127.0.0.1:<port> with no/garbage params.

Common situations: Reusing a stale browser tab from a prior login attempt while a new one is pending; running two `kimchi login` flows simultaneously; antivirus or security software probing the localhost port; session map entries crossed after rapid retry.

Related errors

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/57933844fc4eb7b7. Report an issue: GitHub.