zed-industries/zed · error

missing 'state' parameter in OAuth callback

Error message

missing 'state' parameter in OAuth callback

What it means

Parse guard in OAuthCallbackParams::parse_query: the callback request lacked a `state` parameter, so the response cannot be matched to the pending sign-in attempt (CSRF/session correlation fails) and it is rejected.

Source

Thrown at crates/oauth_callback_server/src/oauth_callback_server.rs:215

                        if !value.is_empty() {
                            error_description = Some(value.into_owned());
                        }
                    }
                    _ => {}
                }
            }

            if let Some(error_code) = error {
                anyhow::bail!(
                    "OAuth authorization failed: {} ({})",
                    error_code,
                    error_description.as_deref().unwrap_or("no description")
                );
            }

            let code = code.ok_or_else(|| anyhow!("missing 'code' parameter in OAuth callback"))?;
            let state =
                state.ok_or_else(|| anyhow!("missing 'state' parameter in OAuth callback"))?;

            Ok(Self { code, state })
        }
    }

    /// How long to wait for the browser to complete the OAuth flow before giving
    /// up and releasing the loopback port.
    const OAUTH_CALLBACK_TIMEOUT: Duration = Duration::from_secs(2 * 60);

    /// Start a loopback HTTP server to receive the OAuth authorization callback.
    ///
    /// Binds to an ephemeral loopback port. Returns `(redirect_uri, callback_future)`.
    /// The caller should use the redirect URI in the authorization request, open
    /// the browser, then await the future to receive the callback.
    pub fn start_oauth_callback_server() -> Result<(
        String,
        futures::channel::oneshot::Receiver<Result<OAuthCallbackParams>>,
    )> {

View on GitHub (pinned to f4178619ac)

Solutions

1. Restart the OAuth sign-in flow so a fresh state is issued
2. Check that the authorization URL included the state parameter and the provider echoes it back

When it happens

Trigger: Thrown at crates/oauth_callback_server/src/oauth_callback_server.rs:215 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zed-industries/zed@f4178619ac (2026-08-20). Data as JSON: /api/errors/eaac7daeea2bf1bf. Report an issue: GitHub.