microsoft/semantic-kernel · warning · HTTPException

Invalid parameter types

Error message

Invalid parameter types

What it means

Raised as HTTPException(400) by SimpleAuthProvider.handle_login_callback when username, password, or state are present but not str instances — typically Starlette UploadFile objects from a multipart form with wrong encoding. The handler needs plain string form values.

Source

Thrown at python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py:151

        </body>
        </html>
        """

        return HTMLResponse(content=html_content)

    async def handle_login_callback(self, request: Request) -> Response:
        """Handle login form submission callback."""
        form = await request.form()
        username = form.get("username")
        password = form.get("password")
        state = form.get("state")

        if not username or not password or not state:
            raise HTTPException(400, "Missing username, password, or state parameter")

        # Ensure we have strings, not UploadFile objects
        if not isinstance(username, str) or not isinstance(password, str) or not isinstance(state, str):
            raise HTTPException(400, "Invalid parameter types")

        redirect_uri = await self.handle_simple_callback(username, password, state)
        return RedirectResponse(url=redirect_uri, status_code=302)

    async def handle_simple_callback(self, username: str, password: str, state: str) -> str:
        """Handle simple authentication callback and return redirect URI."""
        state_data = self.state_mapping.get(state)
        if not state_data:
            raise HTTPException(400, "Invalid state parameter")

        redirect_uri = state_data["redirect_uri"]
        code_challenge = state_data["code_challenge"]
        redirect_uri_provided_explicitly = state_data["redirect_uri_provided_explicitly"] == "True"
        client_id = state_data["client_id"]
        resource = state_data.get("resource")  # RFC 8707

        # These are required values from our own state mapping
        assert redirect_uri is not None

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Ensure the login form uses the default application/x-www-form-urlencoded encoding (no enctype=multipart/form-data) and contains no file inputs.
2. Remove any <input type=file> from the login form.
3. In tests, post URL-encoded form data, not multipart files.
4. Optionally read UploadFile values before validation if file uploads are intentional.

Example fix

// before
<form method=post action=/login/callback enctype=multipart/form-data>
  <input name=username>
  ...
</form>

// after
<form method=post action=/login/callback>
  <input name=username>
  <input name=password type=password>
  <input type=hidden name=state value="{{ state }}">
</form>

if not all(isinstance(form.get(k), str) for k in ('username','password','state')):
    raise HTTPException(400, 'Fields must be plain text, not file uploads')
await oauth_provider.handle_login_callback(request)

from starlette.datastructures import UploadFile

def form_fields_are_strings(form) -> bool:
    return all(
        isinstance(form.get(k), str) and not isinstance(form.get(k), UploadFile)
        for k in ('username', 'password', 'state')
    )

When it happens

Trigger: The form is submitted as multipart/form-data with file inputs, making Starlette return UploadFile objects for username/password/state; a client posts file uploads into text fields; the form's enctype is set to multipart unnecessarily.

Common situations: An accidentally added <input type=file>; a testing tool posting multipart bodies; a browser extension altering form encoding; copy-paste introducing a file field.

Related errors

• Missing username, password, or state parameter
• Missing state parameter
• Missing state parameter
• Missing state parameter
• OAuth error: {self.callback_data['error']}

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/244e681f4beadf69. Report an issue: GitHub.