theonedev/onedev · warning · BadRequestException

Pop state data is missing

Error message

Pop state data is missing

What it means

BasePage installs an AJAX behavior for browser popstate (history back/forward). The behavior reads the 'data' post parameter containing encrypted/serialized view state; if the parameter is absent it throws BadRequestException('Pop state data is missing').

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/base/BasePage.java:247

				&& new File(Bootstrap.installDir, Upgrade.INCOMPATIBILITIES_SINCE_UPGRADED_VERSION_FILE).exists()) {
			throw new RestartResponseAtInterceptPageException(IncompatibilitiesPage.class);
		}

		AbstractPostAjaxBehavior popStateBehavior;
		add(popStateBehavior = new AbstractPostAjaxBehavior() {

			@Override
			protected void updateAjaxAttributes(AjaxRequestAttributes attributes) {
				super.updateAjaxAttributes(attributes);
				attributes.setMethod(Method.POST);
			}

			@Override
			protected void respond(AjaxRequestTarget target) {
				IRequestParameters params = RequestCycle.get().getRequest().getPostParameters();
				String encodedData = params.getParameterValue("data").toString();
				if (encodedData == null) 
					throw new BadRequestException("Pop state data is missing");

				byte[] bytes = Base64.decodeBase64(encodedData.getBytes());
				Serializable data = (Serializable) SerializationUtils.deserialize(CryptoUtils.decrypt(bytes));
				onPopState(target, data);
				resizeWindow(target);
				target.appendJavaScript("onedev.server.viewState.getFromHistoryAndSetToView();");
			}

		});

		add(new Label("pageTitle", getPageTitle()) {

			@Override
			public void renderHead(IHeaderResponse response) {
				super.renderHead(response);

				response.render(JavaScriptHeaderItem.forReference(new BaseResourceReference()));

View on GitHub (pinned to d44925c47c)

Solutions

1. Reload the page fresh (F5) so the client sends full view state.
2. Clear browser history/cache for the OneDev site.
3. Retry after a hard refresh; if scripting the endpoint, always include the base64 'data' parameter.

Example fix

// before: POST without body param
// after
POST data=<base64-encoded encrypted state>

if (!postParams.contains("data")) { reloadPage(); return; }

try {
    respondPopState(params);
} catch (BadRequestException e) {
    // stale/missing history state: force a full reload
    target.appendJavaScript("window.location.reload()");
}

When it happens

Trigger: An AJAX popstate callback arrives without the expected 'data' parameter, typically from a crafted/stale request or an old browser state that predates the parameter being sent.

Common situations: Stale browser tabs after a OneDev upgrade; scripting/testing tools hitting the AJAX endpoint directly; corrupted history state.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• Markup id set on a component that renders its body only. Mar
• Placeholder tag set on a component that renders its body onl
• cannot update component that does not have setOutputMarkupId
• Invalid value '${value}' for ${type} '${name}'. Valid values
• Access token owner should have permission to manage authoriz

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/fdfda4d01383879a. Report an issue: GitHub.