netbirdio/netbird · error

Failed to validate token

Error message

Failed to validate token

What it means

Error "Failed to validate token" thrown in netbirdio/netbird.

Source

Thrown at management/server/http/handlers/proxy/auth.go:99

		http.Error(w, "Failed to create OIDC provider", http.StatusInternalServerError)
		return
	}

	token, err := (&oauth2.Config{
		ClientID:    oidcConfig.ClientID,
		Endpoint:    provider.Endpoint(),
		RedirectURL: oidcConfig.CallbackURL,
	}).Exchange(r.Context(), r.URL.Query().Get("code"), oauth2.VerifierOption(codeVerifier))
	if err != nil {
		log.WithError(err).Error("Failed to exchange code for token")
		http.Error(w, "Failed to exchange code for token", http.StatusInternalServerError)
		return
	}

	userID := extractUserIDFromToken(r.Context(), provider, oidcConfig, token)
	if userID == "" {
		log.Error("Failed to extract user ID from OIDC token")
		http.Error(w, "Failed to validate token", http.StatusUnauthorized)
		return
	}

	// Group validation is performed by the proxy via ValidateSession gRPC call.
	// This allows the proxy to show 403 pages directly without redirect dance.

	sessionToken, err := h.proxyService.GenerateSessionToken(r.Context(), redirectURL.Hostname(), userID, auth.MethodOIDC)
	if err != nil {
		log.WithError(err).Error("Failed to create session token")
		redirectURL.Scheme = "https"
		query := redirectURL.Query()
		query.Set("error", "access_denied")
		query.Set("error_description", sessionTokenErrorDescription(err))
		redirectURL.RawQuery = query.Encode()
		http.Redirect(w, r, redirectURL.String(), http.StatusFound)
		return
	}

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at management/server/http/handlers/proxy/auth.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/07c07519633628c6. Report an issue: GitHub.