hashicorp/vault · error · Error

Missing required query params

Error message

Missing required query params

What it means

Thrown by the OIDC provider route model (ui/app/routes/vault/cluster/oidc-provider.js:134). The route proxies the browser to Vault's identity OIDC provider authorize endpoint; before issuing the GET it mirrors the endpoint's contract by verifying that the request carries a redirect_uri query param and throws if it is absent.

Source

Thrown at ui/app/routes/vault/cluster/oidc-provider.js:134

    const { provider_name, namespace, ...qp } = params;
    const decodedRedirect = decodeURI(qp.redirect_uri);
    return {
      provider_name,
      qp,
      decodedRedirect,
      namespace,
    };
  }

  async model(params) {
    const modelInfo = this._getInfoFromParams(params);
    const { qp, decodedRedirect, ...routeParams } = modelInfo;
    const endpoint = this._buildUrl(
      `${this.win.origin}/v1/identity/oidc/provider/${routeParams.provider_name}/authorize`,
      qp
    );
    if (!qp.redirect_uri) {
      throw new Error('Missing required query params');
    }
    try {
      const response = await this.auth.ajax(endpoint, 'GET', { namespace: routeParams.namespace });
      if ('consent' === qp.prompt?.toLowerCase()) {
        return {
          consent: {
            code: response.code,
            redirect: decodedRedirect,
            state: qp.state,
          },
        };
      }
      return this._handleSuccess(response, decodedRedirect, qp.state);
    } catch (errorRes) {
      const resp = await errorRes.json();
      const code = resp.error;
      // This go-multierror package formats multiple errors as a single string:
      // https://github.com/hashicorp/go-multierror/blob/main/format.go#L28

View on GitHub (pinned to 744b611b57)

Solutions

1. Include a valid redirect_uri (and the usual state/scope params) in the authorize URL: /ui/vault/cluster/oidc-provider/<name>/authorize?redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&...
2. Ensure the relying party's OIDC client is configured to send redirect_uri
3. URL-encode all query parameter values

// Validate required authorize params before entering the provider route
const required = ['redirect_uri'];
const missing = required.filter((p) => !params[p]);
if (missing.length) {
  renderBadRequest(`Missing required query params: ${missing.join(', ')}`);
  return;
}

function hasRedirectUri(qp: Record<string, string | undefined>): qp is { redirect_uri: string } {
  return typeof qp.redirect_uri === 'string' && qp.redirect_uri.length > 0;
}

try {
  await this.router.transitionTo('vault.cluster.oidc-provider', { queryParams: params });
} catch (e) {
  if (e.message === 'Missing required query params') {
    notifyUser('The authorize URL must include redirect_uri (and should include state)');
  } else {
    throw e;
  }
}

When it happens

Trigger: Loading /ui/vault/cluster/oidc-provider/<provider_name>/authorize (or the route's URL shape) without a redirect_uri query parameter, or with it spelled/encoded incorrectly so qp.redirect_uri is undefined.

Common situations: A relying party starts the flow without registering a redirect_uri; a hand-crafted or bookmarked authorize URL missing params; params stripped by a proxy or lost during URL encoding.

Related errors

• A record already exists with the name: ${name}
• Invalid URL
• Vault expects data to be formatted as an JSON object.
• Invalid URL
• Given param is not a supported tool action

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/ac3f4dbb8080fe9a. Report an issue: GitHub.