zed-industries/zed · error

OAuth callback has no query string

Error message

OAuth callback has no query string

What it means

In handle_oauth_callback_request: the incoming OAuth callback request's URL has no query component, so required parameters (code, state, error) cannot be extracted. Indicates a malformed or manually-truncated callback request.

Source

Thrown at crates/oauth_callback_server/src/oauth_callback_server.rs:363

        });

        Ok((redirect_uri, rx))
    }

    fn handle_oauth_callback_request(
        request: &tiny_http::Request,
        expected_path: &str,
    ) -> Result<OAuthCallbackParams> {
        let url = Url::parse(&format!("http://localhost{}", request.url()))
            .context("malformed callback request URL")?;

        if url.path() != expected_path {
            anyhow::bail!("unexpected path in OAuth callback: {}", url.path());
        }

        let query = url
            .query()
            .ok_or_else(|| anyhow!("OAuth callback has no query string"))?;
        OAuthCallbackParams::parse_query(query)
    }

    /// Callback path reserved for evicting a previously-running OAuth callback
    /// server bound to the same port. Always handled, regardless of `config.path`.
    const CANCEL_PATH: &str = "/cancel";

    const BIND_MAX_ATTEMPTS: u32 = 10;
    const BIND_RETRY_DELAY: Duration = Duration::from_millis(200);
    const CANCEL_REQUEST_TIMEOUT: Duration = Duration::from_secs(2);

    fn bind_callback_server(config: &OAuthCallbackServerConfig) -> Result<tiny_http::Server> {
        // Ephemeral ports always succeed; skip the cancel-retry dance entirely.
        if config.preferred_port == 0 {
            let addr = format!("{}:0", config.host);
            return tiny_http::Server::http(&addr).map_err(|err| {
                anyhow!(err).context(format!(
                    "Failed to bind loopback listener for OAuth callback on {addr}"

View on GitHub (pinned to f4178619ac)

Solutions

  1. Retry the OAuth sign-in from the start
  2. Check the provider's redirect URI/response configuration
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at crates/oauth_callback_server/src/oauth_callback_server.rs:363 when the library encounters an invalid state.

Common situations: See trigger scenarios.


AI-assisted analysis of zed-industries/zed@f4178619ac (2026-08-20). Data as JSON: /api/errors/fe345202dee571c8. Report an issue: GitHub.