Discord OAuth2 authentication fails due to unclosed PHP comment in OAuthStateCookie.php

Read app/Helpers/OAuthStateCookie.php and inspect the license comment before the namespace declaration. The report identifies the missing comment terminator as the cause of Composer's PSR-4 autoload warning and failed class lookup. Confirm PHP syntax and that Composer can load App\Helpers\OAuthStateCookie; done means the class loads and the reported OAuth authentication failure is resolved.

Discord OAuth2 authentication unexpectedly stopped working on our production FeatherPanel installation.

After investigating the application logs, we identified repeated errors:

Class "App\Helpers\OAuthStateCookie" not found

The affected file is app/Helpers/OAuthStateCookie.php.

The PHP license header contains an unclosed block comment. The final line of the comment is * instead of */, causing PHP to treat the namespace, imports, and class declaration as comment text.

As a result, Composer cannot autoload App\Helpers\OAuthStateCookie, which is required by DiscordController.php during OAuth2 authentication.

The issue was also confirmed by a Composer PSR-4 warning. A manual correction of the closing comment was applied locally.

SUGGESTED FIX
In app/Helpers/OAuthStateCookie.php, replace the incomplete closing line of the license comment:

 *
 
namespace App\Helpers;

With:

 */

namespace App\Helpers;

This restores the class declaration and allows Composer to load the helper through the existing PSR-4 mapping.

The correction should be included in an official FeatherPanel release to prevent the issue from recurring after updates.

Command used to fix the issue

docker exec featherpanel_backend sh -c '
cd /var/www/html || exit 1

FILE="app/Helpers/OAuthStateCookie.php"

Create a backup

cp -p "$FILE" "${FILE}.bak"

Fix the unclosed PHP comment

sed -i "/^namespace App\\Helpers;/i */" "$FILE"

Verify PHP syntax

php -l "$FILE"

Verify Composer autoloading

php -r '''
require "storage/packages/autoload.php";
echo class_exists("App\Helpers\OAuthStateCookie")
? "CLASS_AVAILABLE\n"
: "CLASS_NOT_FOUND\n";
''''

Expected output:
No syntax errors detected in app/Helpers/OAuthStateCookie.php
CLASS_AVAILABLE

---

Automatic environment

• FeatherPanel: v1.5.3 (stable)
• PHP: 8.5.12 / frankenphp
• OS: Linux 5.15.0-202-generic
• Install: docker
• Users / servers / nodes: 50 / 26 / 2
• Plugins: 17

---

Reported from Mythic Cloud

• Team: Alexander Davila's Team
• Reporter: Alexander Davila
• Cloud: VoryxHost

---

Environment

• Version: v1.5.3
• PHP: 8.5.12
• Database: mysql
• OS: Linux
• Install type: docker
• Approx. users: 50
• Approx. servers / nodes: 26

Plugins / addons

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Extensions / modules

Core
date
lexbor
openssl
pcre
sqlite3
zlib
ctype
curl
uri
json
fileinfo
filter
hash
iconv
SPL
mbstring
Zend OPcache
session
standard
PDO
pdo_sqlite
bz2
posix
random
readline
Reflection
libxml
SimpleXML
tokenizer
dom
xml
xmlreader
xmlwriter
mysqlnd
frankenphp
bcmath
Phar
gd
gmp
imagick
intl
ldap
mongodb
mysqli
pdo_mysql
pdo_pgsql
pgsql
redis
sodium
yaml
zip

Steps to reproduce

1. Install or update to an affected FeatherPanel version.
2. Configure and enable Discord OAuth2.
3. Attempt to authenticate using Discord.
4. Observe that the OAuth2 authentication process fails.
5. Inspect storage/logs/App.fplog for Class "App\Helpers\OAuthStateCookie" not found.
6. Run class_exists("App\\Helpers\\OAuthStateCookie") after loading storage/packages/autoload.php. The result is false.
7. Inspect the PHP license header in app/Helpers/OAuthStateCookie.php and observe the missing */.

Expected behavior

Discord OAuth2 authentication should complete successfully, and the App\Helpers\OAuthStateCookie class should be correctly loaded through Composer's PSR-4 autoloader without errors.

Actual behavior

Discord OAuth2 authentication fails because the OAuthStateCookie class cannot be found.

Application logs repeatedly report:

Class "App\Helpers\OAuthStateCookie" not found

Composer also reports that the class does not comply with PSR-4 autoloading standards.

The issue potentially affects other authentication mechanisms, including OIDC and SSO, which reference the same helper class.

Sensitive diagnostics (logs, install/node URLs, auto-uploaded pastes) are available on Mythic only.

---

Reported via Mythic Issues by Alexander Davila