router-for-me/CLIProxyAPI · error

No state parameter received

Error message

No state parameter received

What it means

The Claude OAuth callback had a code but no state query parameter, so the anti-CSRF check cannot proceed. The handler sends OAuthResult{Error: "no_state"} and returns HTTP 400 "No state parameter received".

Source

Thrown at internal/auth/claude/oauth_server.go:210

	}

	if code == "" {
		log.Error("No authorization code received")
		result := &OAuthResult{
			Error: "no_code",
		}
		s.sendResult(result)
		http.Error(w, "No authorization code received", http.StatusBadRequest)
		return
	}

	if state == "" {
		log.Error("No state parameter received")
		result := &OAuthResult{
			Error: "no_state",
		}
		s.sendResult(result)
		http.Error(w, "No state parameter received", http.StatusBadRequest)
		return
	}

	// Send successful result
	result := &OAuthResult{
		Code:  code,
		State: state,
	}
	s.sendResult(result)

	// Redirect to success page
	http.Redirect(w, r, "/success", http.StatusFound)
}

// handleSuccess handles the success page endpoint.
// It serves a user-friendly HTML page indicating that authentication was successful.
//
// Parameters:

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Re-run the login flow so the browser delivers both code and state as issued
2. Verify the provider's redirect configuration passes through the full query string
3. When testing manually, include both parameters: /callback?code=abc&state=<the state your flow generated>

Example fix

# before
curl "http://127.0.0.1:1455/auth/callback?code=abc"
# 400 No state parameter received

# after
curl "http://127.0.0.1:1455/auth/callback?code=abc&state=xyz"

q := u.Query()
if q.Get("state") == "" { return errors.New("callback URL missing state parameter") }

func callbackHasState(u *url.URL) bool { return u.Query().Get("state") != "" }

result, err := server.WaitForCode(ctx)
if err == nil && result.Error == "no_state" { /* restart login; ensure IdP passes through the full query string */ }

When it happens

Trigger: GET /callback?code=abc with state missing, emptied, or renamed (?st=, ?session=) by manual editing or a misconfigured IdP redirect template.

Common situations: Provider redirect-uri templates that drop unknown params; hand-crafted callback URLs during testing; auth flows through intermediaries that whitelist only certain query keys.

Related errors

• fetch Claude OAuth %s: HTTP client is nil
• fetch Claude OAuth %s: access token is empty
• fetch Claude OAuth %s: %w
• read Claude OAuth %s response: %w
• decode Claude OAuth gzip response: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/df95ee03172323aa. Report an issue: GitHub.