microsoft/semantic-kernel · warning · HTTPException

Missing username, password, or state parameter

Error message

Missing username, password, or state parameter

What it means

Raised as HTTPException(400) by SimpleAuthProvider.handle_login_callback when the submitted login form is missing username, password, or state. The POST /login/callback handler reads the three form fields and requires all three to proceed with authentication.

Source

Thrown at python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py:147

                    <input type="password" name="password" value="demo_password" required>
                </div>
                <button type="submit">Sign In</button>
            </form>
        </body>
        </html>
        """

        return HTMLResponse(content=html_content)

    async def handle_login_callback(self, request: Request) -> Response:
        """Handle login form submission callback."""
        form = await request.form()
        username = form.get("username")
        password = form.get("password")
        state = form.get("state")

        if not username or not password or not state:
            raise HTTPException(400, "Missing username, password, or state parameter")

        # Ensure we have strings, not UploadFile objects
        if not isinstance(username, str) or not isinstance(password, str) or not isinstance(state, str):
            raise HTTPException(400, "Invalid parameter types")

        redirect_uri = await self.handle_simple_callback(username, password, state)
        return RedirectResponse(url=redirect_uri, status_code=302)

    async def handle_simple_callback(self, username: str, password: str, state: str) -> str:
        """Handle simple authentication callback and return redirect URI."""
        state_data = self.state_mapping.get(state)
        if not state_data:
            raise HTTPException(400, "Invalid state parameter")

        redirect_uri = state_data["redirect_uri"]
        code_challenge = state_data["code_challenge"]
        redirect_uri_provided_explicitly = state_data["redirect_uri_provided_explicitly"] == "True"
        client_id = state_data["client_id"]

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Ensure the login form includes all three fields (username, password, and the hidden state input) and the user fills username and password.
2. Add client-side required-field validation on the form before submission.
3. Verify the form HTML in get_login_page still emits the state hidden input.
4. For API clients, include all three fields in the POST body.

Example fix

// before
<form method=post action=/login/callback>
  <input name=username>
  <input name=password type=password>
</form>

// after
<form method=post action=/login/callback>
  <input name=username required>
  <input name=password type=password required>
  <input type=hidden name=state value="{{ state }}">
</form>

missing = [k for k in ('username','password','state') if not form.get(k)]
if missing:
    raise HTTPException(400, f'Missing fields: {missing}')
await oauth_provider.handle_login_callback(request)

def form_has_required_fields(form) -> bool:
    return all(form.get(k) for k in ('username', 'password', 'state'))

When it happens

Trigger: The login form is submitted with any of username/password/state blank; a client posts a partial form; the form fields were renamed in the HTML but not in the handler; a scripted request omits a field.

Common situations: User leaves a field empty; browser autofill failure; a custom client posting malformed credentials; the hidden 'state' input was stripped from the form HTML.

Related errors

• Missing state parameter
• Missing state parameter
• Missing state parameter
• Invalid parameter types
• OAuth error: {self.callback_data['error']}

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/6465a893d4836e56. Report an issue: GitHub.