prestodb/presto · error · ChallengeFailedException

State validation failed

Error message

State validation failed

What it means

OAuth2Service.parseState failed to verify the 'state' parameter of the authentication response (JWT signature/expiry/claims check threw), so the response cannot be tied back to the original authentication request; possible CSRF/replay or malformed state. The user sees a 400 with an internal-failure page and the nonce cookie is cleared.

Source

Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OAuth2Service.java:248

            handlerState.ifPresent(value ->
                    tokenHandler.setTokenExchangeError(value, format("Authentication response could not be verified: state=%s", value)));
            return Response.status(BAD_REQUEST)
                    .cookie(NonceCookie.delete())
                    .entity(getInternalFailureHtml("Authentication response could not be verified"))
                    .build();
        }
    }

    private Claims parseState(String state)
            throws ChallengeFailedException
    {
        try {
            return jwtParser
                    .parseClaimsJws(state)
                    .getBody();
        }
        catch (RuntimeException e) {
            throw new ChallengeFailedException("State validation failed", e);
        }
    }

    public String getSuccessHtml()
    {
        return successHtml;
    }

    public String getCallbackErrorHtml(String errorCode)
    {
        return failureHtml.replace(FAILURE_REPLACEMENT_TEXT, getOAuth2ErrorMessage(errorCode));
    }

    public String getInternalFailureHtml(String errorMessage)
    {
        return failureHtml.replace(FAILURE_REPLACEMENT_TEXT, nullToEmpty(errorMessage));
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Restart the OAuth2 login flow to obtain a fresh state cookie
2. Check coordinator clock skew and oauth state signing key configuration if it fails consistently

When it happens

Trigger: Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OAuth2Service.java:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/7b69ec61c9b87b57. Report an issue: GitHub.