vxcontrol/pentagi · warning

Auth.InvalidLoginCallbackRequest

Auth.InvalidLoginCallbackRequest

Error message

code is required

What it means

Auth.InvalidLoginCallbackRequest is returned by AuthLoginGetCallback when the OAuth2 login callback request arrives without the mandatory 'code' query parameter. The code is the authorization code the identity provider redirects back with; without it the server cannot proceed with the token exchange. The handler rejects the request immediately before touching cookies or state.

Source

Thrown at backend/pkg/server/services/auth.go:343

		http.StatusTemporaryRedirect)
}

// AuthLoginGetCallback is function to catch login callback from OAuth application with code only
// @Summary Login user from external OAuth application
// @Tags Public
// @Accept json
// @Produce json
// @Param code query string false "Auth code from OAuth provider to exchange token"
// @Success 303 "redirect to registered return_uri path in the state"
// @Failure 400 {object} response.errorResp "invalid login data"
// @Failure 401 {object} response.errorResp "invalid login or password"
// @Failure 403 {object} response.errorResp "login not permitted"
// @Failure 500 {object} response.errorResp "internal error on login"
// @Router /auth/login-callback [get]
func (s *AuthService) AuthLoginGetCallback(c *gin.Context) {
	code := c.Query("code")
	if code == "" {
		response.Error(c, response.ErrAuthInvalidLoginCallbackRequest, fmt.Errorf("code is required"))
		return
	}

	state, err := c.Request.Cookie(s.stateCookieName())
	if err != nil {
		logger.FromContext(c).WithError(err).Errorf("error getting state from cookie")
		response.Error(c, response.ErrAuthInvalidAuthorizationState, err)
		return
	}

	queryState := c.Query("state")
	if queryState == "" {
		logger.FromContext(c).Errorf("error missing state parameter in OAuth callback")
		response.Error(c, response.ErrAuthInvalidAuthorizationState, fmt.Errorf("state parameter is required"))
		return
	}

	if queryState != state.Value {

View on GitHub (pinned to ea665308ba)

Solutions

1. Ensure the OAuth2 authorize URL's redirect_uri points users to /auth/login-callback and that the IdP appends ?code=... on redirect
2. Initiate login via the proper /auth/login endpoint so the OAuth flow (and code) is generated
3. Check the IdP provider configuration (response_type=code) and that the client is not in a broken/partial auth state
4. Retry the login from the UI instead of reloading the callback URL

Example fix

// before
window.location = '/auth/login-callback'
// after
const res = await fetch('/auth/login') // server redirects to IdP, which redirects back with ?code=...

const url = new URL(window.location.href)
if (!url.searchParams.get('code')) {
  // redirect to /auth/login to restart the flow
}

function hasOAuthCode(url: URL): url is URL & { searchParams: URLSearchParams } {
  return typeof url.searchParams.get('code') === 'string' && url.searchParams.get('code') !== ''
}

When it happens

Trigger: GET /auth/login-callback (or POST variant invoking the same flow) with no ?code= query parameter, e.g. a user bookmarking the callback URL, an IdP redirect that dropped the code, or a manually crafted request.

Common situations: Users re-opening a stale callback URL after the OAuth redirect expired; misconfigured IdP redirect URIs that hit the endpoint without completing authorization; health checks or crawlers scraping the callback path; frontends calling the callback directly instead of following the IdP redirect.

Related errors

• Auth.InvalidAuthorizationState
• Auth.TokenExpired
• time_start and time_end are required for temporal_window sea
• center_node_uuid is required for entity_relationships search
• unexpected status code: %d

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/c9ff7d6c86bf6e2d. Report an issue: GitHub.