bug: OIDC not working with Cloudflare Zero Trust / SaaS

[autumnwalker]

Describe the bug

Attempting to configure Homarr using OIDC via Cloudflare Zero Trust / Generic OIDC. When I set up the variables in https://homarr.dev/docs/advanced/single-sign-on/ I get the following error in my logs:

2025-11-03T16:41:32.701Z error: Read more at https://errors.authjs.dev#callbackrouteerror name="o" type="CallbackRouteError" kind="error"
    at dH (/app/apps/nextjs/.next/server/chunks/8673.js:405:19222)
    at async dQ (/app/apps/nextjs/.next/server/chunks/8673.js:405:26325)
    at async dS (/app/apps/nextjs/.next/server/chunks/8673.js:405:31006)
    at async i (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:2373)
    at async rN.do (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:21042)
    at async rN.handle (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:25860)
    at async k (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:7227)
    at async rN.handleResponse (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:1:105568)
    at async g (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:8230)
    at async x (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:9352)
caused by {"err":{"code":"OAUTH_INVALID_RESPONSE","name":"t"},"expected":"[string redacted]","parameters":{},"provider":"oidc"}

Steps to reproduce

Configure generic OIDC SaaS app via Cloudflare Zero Trust following paramaters from Homarr SSO documents.

Impact

Cannot login to Homarr / complete initial setup.

Additional information

I am using Entra as my IdP so I removed the "groups" scope and set "AUTH_OIDC_GROUPS_ATTRIBUTE" as "roles" as I have read in the documentation for "Azure".

Version

1.43.1

Installation method

Unraid Apps

Browser

Edge (Chromium)

[autumnwalker]

If I put the groups scope back in I get a different set of errors:

2025-11-03T17:50:44.938Z error: Read more at https://errors.authjs.dev#oauthprofileparseerror name="C" type="OAuthProfileParseError" kind="error"
    at dw (/app/apps/nextjs/.next/server/chunks/8673.js:405:9456)
    at dv (/app/apps/nextjs/.next/server/chunks/8673.js:405:9153)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async dH (/app/apps/nextjs/.next/server/chunks/8673.js:405:14482)
    at async dQ (/app/apps/nextjs/.next/server/chunks/8673.js:405:26325)
    at async dS (/app/apps/nextjs/.next/server/chunks/8673.js:405:31006)
    at async i (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:2373)
    at async rN.do (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:21042)
    at async rN.handle (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:25860)
    at async k (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:7227)
caused by {"err":{},"provider":"oidc"}
2025-11-03T17:50:44.965Z error: State could not be decoded. Read more at https://errors.authjs.dev#invalidcheck name="u" type="InvalidCheck" kind="error"
    at Object.decode (/app/apps/nextjs/.next/server/chunks/8673.js:405:5121)
    at async dH (/app/apps/nextjs/.next/server/chunks/8673.js:405:14283)
    at async dQ (/app/apps/nextjs/.next/server/chunks/8673.js:405:26325)
    at async dS (/app/apps/nextjs/.next/server/chunks/8673.js:405:31006)
    at async i (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:2373)
    at async rN.do (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:21042)
    at async rN.handle (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:25860)
    at async k (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:7227)
    at async rN.handleResponse (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:1:105568)
    at async g (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:8230)
caused by ar: decryption operation failed code="ERR_JWE_DECRYPTION_FAILED"
    at bc (/app/apps/nextjs/.next/server/chunks/8673.js:2:83070)
    at async by (/app/apps/nextjs/.next/server/chunks/8673.js:2:102256)
    at async bz (/app/apps/nextjs/.next/server/chunks/8673.js:2:102829)
    at async bB (/app/apps/nextjs/.next/server/chunks/8673.js:2:103113)
    at async bQ (/app/apps/nextjs/.next/server/chunks/8673.js:2:108513)
    at async Object.decode (/app/apps/nextjs/.next/server/chunks/8673.js:405:5015)
    at async dH (/app/apps/nextjs/.next/server/chunks/8673.js:405:14283)
    at async dQ (/app/apps/nextjs/.next/server/chunks/8673.js:405:26325)
    at async dS (/app/apps/nextjs/.next/server/chunks/8673.js:405:31006)
    at async i (/app/apps/nextjs/.next/server/app/api/auth/[...nextauth]/route.js:1:2373)

[Meierschlumpf]

Just to be sure, you've configured a oidc app registration (based on your statement that you are using entra) and not oauth, correct?
Not sure why it can not decode the state, but the callback route might be because of cloudflare, not sure yet

[autumnwalker]

Just to be sure, you've configured a oidc app registration (based on your statement that you are using entra) and not oauth, correct? Not sure why it can not decode the state, but the callback route might be because of cloudflare, not sure yet

You mean OIDC on the Cloudflare side? Yes, confirmed. Homarr is configured as an OIDC app in Cloudflare Zero Trust.

[Meierschlumpf]

Oh I see you are not using microsoft entra and rather the oidc from cloudflare. I can try to setup it on my side. One thing you could take a look, is if you have configured the flow to be implicit (which is what homarr needs)

[autumnwalker]

Oh I see you are not using microsoft entra and rather the oidc from cloudflare. I can try to setup it on my side. One thing you could take a look, is if you have configured the flow to be implicit (which is what homarr needs)

Thanks! I had not configured the flow to be implicit. I just flipped that on (with both "Return ID Token from Authorization Endpoint" and "Return Access Token from Authorization Endpoint" enabled), but get the same result.

[Meierschlumpf]

Sadly I can not really reproduce it, because I would need to put my credit card into the free plan which I'm not that happy with

[autumnwalker]

Sadly I can not really reproduce it, because I would need to put my credit card into the free plan which I'm not that happy with

Oh, weird. I use some of their other services so they have my card anyway. I didn't realize you needed a card for the free tier.

Is there anything I can do here to provide logs, config details, etc.?

[autumnwalker]

Any additional things to look for here? Updated to latest container and issue persists.

[manuel-rw]

@Meierschlumpf ?

[Meierschlumpf]

In a bit of a sketchy way I was able to add an application for free without adding the credit card. I can confirm, that I also got the jwe decryption error. Wasn't able to dig a lot deeper, only tested if adding the jwks url would be enough (still same issue)

[autumnwalker]

Confirming this is still present in Version 1.43.3.