theonedev/onedev · error · AuthenticationException

Unsolicited OIDC response

Error message

Unsolicited OIDC response

What it means

OpenIdConnector's OAuth callback handling receives an OIDC response whose state parameter does not match an outstanding authentication request (state mismatch or absent session data), so the response cannot be tied to the initiated flow and is treated as unsolicited — a common sign of replay, stale tabs, or CSRF state mismatch.

Source

Thrown at server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java:414

					json.get("authorization_endpoint").asText(),
					json.get("token_endpoint").asText(), 
					json.get("userinfo_endpoint").asText(),
					endSessionEndpointNode != null ? endSessionEndpointNode.asText() : null);
		} catch (IOException | URISyntaxException e) {
			if (e.getMessage() != null) {
				logger.error(_T("Error discovering OIDC metadata"), e);
				throw new AuthenticationException(e.getMessage());
			} else {
				throw new RuntimeException(e);
			}
		}
		
	}
	
	protected ProviderMetadata getCachedProviderMetadata() {
		ProviderMetadata metadata = (ProviderMetadata) Session.get().getAttribute(SESSION_ATTR_PROVIDER_METADATA);
		if (metadata == null)
			throw new AuthenticationException(_T("Unsolicited OIDC response"));
		return metadata;
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Restart the SSO login flow from the OneDev login page.
2. Clear stale cookies/session state and retry; avoid re-submitting old callback URLs.
3. Verify provider state handling and clock/session lifetime settings.

When it happens

Trigger: Thrown at server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java:414 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/2b4ca172ad960927. Report an issue: GitHub.