What causes "Unsolicited discord api response" in theonedev/onedev?

Restart the SSO login from the sign-in button so a fresh Discord API request is cached in the session.

theonedev/onedev · error · AuthenticationException

Unsolicited discord api response

Error message

Unsolicited discord api response

What it means

Thrown by getCachedApiRequest when the Wicket session holds no cached Discord OAuth request metadata while the connector is handling an API callback. Since the connector only accepts callbacks for authorization flows it initiated (state is stored in the session), a callback without that cached request is deemed unsolicited and rejected.

Source

Thrown at server-plugin/server-plugin-sso-discord/src/main/java/io/onedev/server/plugin/sso/discord/DiscordConnector.java:165

		} catch (IOException | JSONException e) {
			throw new RuntimeException(e);
		}
	}
	
	private String getScopes() {
		String scopes = "identify email";
		if (!StringUtils.isEmpty(this.serverId)) {
			scopes += " guilds"; 
		}
		
		return scopes;
	}
	
	private Request getCachedApiRequest() {
		Request metadata = (Request) Session.get().getAttribute(SESSION_ATTR_API_REQUEST);
		
		if (metadata == null) {
			throw new AuthenticationException(_T("Unsolicited discord api response"));
		}
		
		return metadata;
	}
}

View on GitHub (pinned to d44925c47c)

Solutions

Restart the SSO login from the sign-in button so a fresh Discord API request is cached in the session.
Ensure sticky sessions (or a shared session store) when running multiple OneDev nodes behind a load balancer.
Enable browser cookies for the OneDev domain.
Increase session timeout or complete the Discord consent promptly to avoid session expiry mid-flow.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    auth = connector.handleAuthResponse(...);
} catch (AuthenticationException e) {
    if (e.getMessage().contains("Unsolicited discord api response")) {
        // restart login flow from the sign-in button
    }
}

Prevention

Use sticky sessions or shared session storage in clustered deployments.
Never open the SSO callback URL directly.
Keep session timeout longer than the Discord consent flow.
Ensure cookies are not blocked by browser privacy settings.

When it happens

Trigger: A request hits the Discord SSO callback handling path (via apiRequest -> getCachedApiRequest) but SESSION_ATTR_API_REQUEST was never set — e.g. the callback URL was opened directly, the session expired/was recreated between initiating login and the redirect, or a different server node handled the callback than the one that started the flow.

Common situations: Session cookie lost or blocked; login initiated on one OneDev node and callback routed to another in a load-balanced cluster without sticky sessions; user bookmarks/reloads the callback URL; long delay at Discord consent page causing session timeout.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/ff68630375a28df2. Report an issue: GitHub.