git-ecosystem/git-credential-manager · error · ArgumentOutOfRangeException

Unknown OAuth2 response mode.

Error message

Unknown OAuth2 response mode.

What it means

OAuth2ResponseMode.GetParameterValue maps the OAuth2ResponseMode enum to its wire value ('query', 'fragment', 'form_post'). An ArgumentOutOfRangeException is thrown for any mode value outside those three, because no corresponding response_mode string exists.

Solutions

1. Pass only OAuth2ResponseMode.Query, .Fragment, or .FormPost to GetParameterValue
2. Use TryParseResponseMode (the parsing helper in the same file) instead of manual casts
3. Validate the enum value before mapping; treat unexpected values as a configuration error
4. Check that the enum was not default-initialized to a value with no wire representation

Example fix

// before
var value = OAuth2ResponseModeExtensions.GetParameterValue((OAuth2ResponseMode)7);
// after
if (OAuth2ResponseModeExtensions.TryParseResponseMode("query", out var mode))
{
    var value = OAuth2ResponseModeExtensions.GetParameterValue(mode);
}

if (mode is not (OAuth2ResponseMode.Query or OAuth2ResponseMode.Fragment or OAuth2ResponseMode.FormPost)) throw new ArgumentException($"Unsupported response mode: {mode}");

bool IsKnownResponseMode(OAuth2ResponseMode m) => m == OAuth2ResponseMode.Query || m == OAuth2ResponseMode.Fragment || m == OAuth2ResponseMode.FormPost;

try { value = OAuth2ResponseModeExtensions.GetParameterValue(mode); } catch (ArgumentOutOfRangeException) { value = OAuth2Constants.AuthorizationEndpoint.QueryResponseMode; }

When it happens

Trigger: Calling GetParameterValue on an OAuth2ResponseMode value not covered by the switch — typically an undefined enum value obtained via an unchecked cast, default initialization, or a value parsed from untrusted input.

Common situations: Deserializing 'response_mode' from an authorization response into the enum without validating; enum default (0) not mapping to a defined mode; adding a new response mode upstream without updating this mapper.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Unknown PKCE code challenge method.
• Unknown authentication mode
• Unexpected AuthenticationModes returned from prompt
• Bitbucket DC OAuth Client ID must be defined
• Bitbucket DC OAuth Client Secret must be defined

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/b85866f456b18094. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/OAuth/OAuth2ResponseMode.cs:52

public static class OAuth2ResponseModeExtensions
{
    /// <summary>
    /// Get the wire value for the <c>response_mode</c> authorization request parameter.
    /// </summary>
    public static string GetParameterValue(this OAuth2ResponseMode mode)
    {
        switch (mode)
        {
            case OAuth2ResponseMode.Default:
                return null;
            case OAuth2ResponseMode.Query:
                return OAuth2Constants.AuthorizationEndpoint.QueryResponseMode;
            case OAuth2ResponseMode.Fragment:
                return OAuth2Constants.AuthorizationEndpoint.FragmentResponseMode;
            case OAuth2ResponseMode.FormPost:
                return OAuth2Constants.AuthorizationEndpoint.FormPostResponseMode;
            default:
                throw new ArgumentOutOfRangeException(nameof(mode), mode, "Unknown OAuth2 response mode.");
        }
    }

    /// <summary>
    /// Try to parse a <c>response_mode</c> wire value into an <see cref="OAuth2ResponseMode"/>.
    /// </summary>
    public static bool TryParse(string value, out OAuth2ResponseMode mode)
    {
        mode = OAuth2ResponseMode.Default;

        if (string.IsNullOrWhiteSpace(value))
        {
            return false;
        }

        if (StringComparer.OrdinalIgnoreCase.Equals(value, OAuth2Constants.AuthorizationEndpoint.QueryResponseMode))
        {
            mode = OAuth2ResponseMode.Query;

View on GitHub (pinned to e8ce762cd0)