gotify/server · error

invalid client name

Error message

invalid client name

What it means

OIDC LoginHandler requires the 'name' query parameter to identify which configured OIDC client to use. If it is missing or empty, the handler responds with 400 'invalid client name' before generating state.

Source

Thrown at api/oidc.go:134

//	---
//	parameters:
//	- name: name
//	  in: query
//	  description: the client name to create after login
//	  required: true
//	  type: string
//	responses:
//	  302:
//	    description: Redirect to OIDC provider
//	  default:
//	    description: Error
//	    schema:
//	        $ref: "#/definitions/Error"
func (a *OIDCAPI) LoginHandler() gin.HandlerFunc {
	return gin.WrapF(func(w http.ResponseWriter, r *http.Request) {
		clientName := r.URL.Query().Get("name")
		if clientName == "" {
			http.Error(w, "invalid client name", http.StatusBadRequest)
			return
		}
		state, err := a.generateState()
		if err != nil {
			http.Error(w, fmt.Sprintf("failed to generate state: %v", err), http.StatusInternalServerError)
			return
		}
		a.pendingSessions.Set(time.Now(), state, &pendingOIDCSession{ClientName: clientName, CreatedAt: time.Now()})
		rp.AuthURLHandler(func() string { return state }, a.Provider, a.promptURLParams()...)(w, r)
	})
}

// swagger:operation GET /auth/oidc/elevate oidc oidcElevate
//
// Start the OIDC flow to elevate an existing client session (browser).
//
// Redirects the user to the OIDC provider's authorization endpoint. After
// successful authentication, the referenced client session is elevated for

View on GitHub (pinned to 14bfc25627)

Solutions

1. Append the configured client name as a query parameter: /oidc/login?name=<clientName>
2. Fix the frontend/application code building the login URL to include the name parameter
3. Verify the client name matches an entry in the server's OIDC client configuration

Example fix

// before
window.location = '/oidc/login'
// after
window.location = '/oidc/login?name=my-oidc-provider'

u, _ := url.Parse("/oidc/login")
q := u.Query()
q.Set("name", clientName)
if clientName == "" {
    log.Fatal("client name is required")
}
u.RawQuery = q.Encode()
http.Redirect(w, r, u.String(), http.StatusFound)

resp, err := http.Get(loginURL)
if resp.StatusCode == 400 {
    body, _ := io.ReadAll(resp.Body)
    if strings.Contains(string(body), "invalid client name") {
        log.Printf("append ?name=<client> to %s", loginURL)
    }
}

When it happens

Trigger: Navigating to the OIDC login endpoint without ?name=<client>, or with name= empty, e.g. /oidc/login instead of /oidc/login?name=provider-a.

Common situations: Frontend links or OIDC client configurations missing the name query param, or users bookmarking the login URL without the parameter.

Related errors

• token exchange failed: %w
• failed to get user info: %w
• unknown or expired state
• issuer claim was empty
• subject claim was empty

AI-assisted analysis of gotify/server@14bfc25627 (2026-09-05). Data as JSON: /api/errors/04e9e4409943ab17. Report an issue: GitHub.