goharbor/harbor · error

invalid OIDC session data format

Error message

invalid OIDC session data format

What it means

Error "invalid OIDC session data format" thrown in goharbor/harbor.

Source

Thrown at src/core/controllers/oidc.go:280

	oidcSettings, err := config.OIDCSetting(ctx)
	if err != nil {
		log.Errorf("Failed to get OIDC settings: %v", err)
		oc.SendInternalServerError(err)
		return
	}
	if oidcSettings == nil {
		log.Error("OIDC settings is missing.")
		oc.SendInternalServerError(fmt.Errorf("OIDC settings is missing"))
		return
	}
	if !oidcSettings.Logout {
		oc.Controller.Redirect("/account/sign-in", http.StatusFound)
		return
	}
	tk, ok := sessionData.([]byte)
	if !ok {
		log.Error("Invalid OIDC session data format.")
		oc.SendInternalServerError(fmt.Errorf("invalid OIDC session data format"))
		return
	}
	token := oidc.Token{}
	if err := json.Unmarshal(tk, &token); err != nil {
		log.Errorf("Error occurred in Unmarshal: %v", err)
		oc.SendInternalServerError(err)
		return
	}
	if token.RefreshToken != "" {
		sessionType, err := getSessionType(token.RefreshToken)
		if err == nil {
			// If the session is offline, try best to revoke the refresh token.
			if strings.ToLower(sessionType) == "offline" && oidc.EndpointsClaims.RevokeURL != "" {
				if err := oidc.RevokeOIDCRefreshToken(oidc.EndpointsClaims.RevokeURL, token.RefreshToken, oidcSettings.ClientID, oidcSettings.ClientSecret, oidcSettings.VerifyCert); err != nil {
					log.Warningf("Failed to revoke the offline session: %v", err)
				}
			}
		}

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/core/controllers/oidc.go:280 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/11db791d234d7446. Report an issue: GitHub.