langflow-ai/langflow · error · HTTPException

An error occurred during authentication

Error message

An error occurred during authentication

What it means

500 from POST /api/v1/login when authenticate_user raises an unexpected (non-HTTP) exception — DB down, password-hasher misconfigured, custom auth plugin crash. The real error is logged server-side ('Authentication error: ...') and deliberately hidden from the client so internals are not leaked. Bad credentials do NOT produce this; they raise 401.

Source

Thrown at src/backend/base/langflow/api/v1/login.py:56

    form_data: Annotated[OAuth2PasswordRequestForm, Depends()],
    db: DbSession,
):
    """Login endpoint with rate limiting applied via app.state.limiter."""
    # Check rate limit (limiter is initialized in main.py after settings load)
    check_rate_limit(request)

    auth_settings = get_settings_service().auth_settings
    try:
        auth = get_auth_service()
        user = await auth.authenticate_user(form_data.username, form_data.password, db, request)
    except Exception as exc:
        if isinstance(exc, HTTPException):
            raise
        # Log the actual error server-side but don't expose it to clients
        from loguru import logger

        logger.error(f"Authentication error: {exc}")
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="An error occurred during authentication",
        ) from exc

    if user:
        tokens = await auth.create_user_tokens(user_id=user.id, db=db, update_last_login=True)
        response.set_cookie(
            "refresh_token_lf",
            tokens["refresh_token"],
            httponly=auth_settings.REFRESH_HTTPONLY,
            samesite=auth_settings.REFRESH_SAME_SITE,
            secure=auth_settings.REFRESH_SECURE,
            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,
            domain=auth_settings.COOKIE_DOMAIN,
        )
        response.set_cookie(
            "access_token_lf",
            tokens["access_token"],

View on GitHub (pinned to 976ec789d2)

Solutions

1. Check server log for 'Authentication error: <exc>' — the actual exception is there
2. Verify DB connectivity and that the user table is reachable
3. If using a custom auth_service plugin, test its authenticate_user directly
4. Confirm required auth settings (secret key, auth backend config) are set in the environment

try:
    tokens = await client.post("/api/v1/login", data={"username": u, "password": p})
except httpx.HTTPStatusError as e:
    if e.response.status_code == 500:
        raise AuthInfrastructureError("login backend broken; check server logs") from e
    raise

When it happens

Trigger: POST /login while the database is unreachable; a custom auth_service plugin (registered via lfx.services entry point) raising; misconfigured secret key making token/hashing setup fail.

Common situations: DB container not up at deploy time; auth plugin version mismatch after upgrade; LANGFLOW_SECRET_KEY missing/rotated; LDAP/OAuth backend behind login crashing.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Incorrect username or password
• parse_exception(exc)
• Error building Component
• Error ingesting via connector.
• Error deleting knowledge base.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/730f345d12b629be. Report an issue: GitHub.