jlcodes99/cockpit-tools · warning

Codex OAuth 回调超时: login_id={}, callback_url={}, elapsed={}s

Error message

Codex OAuth 回调超时: login_id={}, callback_url={}, elapsed={}s

What it means

start_callback_server waits for the OAuth provider to redirect to the local callback URL. If no callback arrives within the configured timeout, it logs this message (including login_id, callback URL and elapsed seconds), sets clear_state_on_exit, and aborts the login. The OAuth session is abandoned rather than waiting forever.

Source

Thrown at crates/cockpit-core/src/modules/codex_oauth.rs:690

    loop {
        let should_stop = {
            let oauth_state = OAUTH_STATE.lock().unwrap();
            match oauth_state.as_ref() {
                Some(state) => state.state != expected_state || state.login_id != expected_login_id,
                None => true,
            }
        };

        if should_stop {
            logger::log_info(&format!(
                "Codex OAuth 已取消或状态已变更，停止回调监听: login_id={}",
                expected_login_id
            ));
            break;
        }

        if start.elapsed() > timeout {
            logger::log_error(&format!(
                "Codex OAuth 回调超时: login_id={}, callback_url={}, elapsed={}s",
                expected_login_id,
                callback_url,
                start.elapsed().as_secs()
            ));
            clear_state_on_exit = true;
            break;
        }

        if let Ok(Some(request)) = server.try_recv() {
            let url = request.url().to_string();

            if url.starts_with("/auth/callback") {
                let has_query = url.contains('?');
                logger::log_info(&format!(
                    "Codex OAuth 收到回调请求: login_id={}, path=/auth/callback, has_query={}",
                    expected_login_id, has_query
                ));

View on GitHub (pinned to 1ed8b77992)

Solutions

1. Restart the OAuth login (start_oauth_login) and complete the browser authentication promptly
2. Ensure the browser can reach the redirect URI (http://localhost:<port>/...) and pop-ups are allowed
3. Check that no proxy/VPN intercepts localhost redirects
4. Verify login_id/state match — a stale pending session may need clearing before retrying

match start_oauth_login(app).await {
    Err(e) if format!("{e}").contains("回调超时") => {
        // state was cleared; prompt user to retry and complete browser step quickly
        start_oauth_login(app).await
    }
    other => other,
}

When it happens

Trigger: User does not complete browser sign-in before the timeout; the browser tab was closed or the redirect never reached 127.0.0.1:<port>; expected_login_id mismatch causes the loop to end and the elapsed time check then fires.

Common situations: Slow/failed provider login page; user switched away and forgot the browser step; corporate proxy intercepting the redirect; pop-up blocked so the auth page never opened.

Related errors

• Codex OAuth 回调超时: login_id={}, callback_url={}, elapsed={}s
• OAuth 回调服务器错误: {}
• Token 交换失败: status={}, body_len={}
• Codex OAuth completed 命令失败: login_id={}, duration_ms={}, err
• OAuth 回调服务器错误: {}

AI-assisted analysis of jlcodes99/cockpit-tools@1ed8b77992 (2026-09-05). Data as JSON: /api/errors/dd522e5f341150a8. Report an issue: GitHub.