{"action":"opened","issue":{"url":"https://api.github.com/repos/jaliss/securesocial/issues/523","labels_url":"https://api.github.com/repos/jaliss/securesocial/issues/523/labels{/name}","comments_url":"https://api.github.com/repos/jaliss/securesocial/issues/523/comments","events_url":"https://api.github.com/repos/jaliss/securesocial/issues/523/events","html_url":"https://github.com/jaliss/securesocial/issues/523","id":57439096,"number":523,"title":"AuthenticationException triggered by bot traffic to /auth/authenticate","user":{"login":"anfuerer","id":857140,"avatar_url":"https://avatars.githubusercontent.com/u/857140?v=3","gravatar_id":"","url":"https://api.github.com/users/anfuerer","html_url":"https://github.com/anfuerer","followers_url":"https://api.github.com/users/anfuerer/followers","following_url":"https://api.github.com/users/anfuerer/following{/other_user}","gists_url":"https://api.github.com/users/anfuerer/gists{/gist_id}","starred_url":"https://api.github.com/users/anfuerer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anfuerer/subscriptions","organizations_url":"https://api.github.com/users/anfuerer/orgs","repos_url":"https://api.github.com/users/anfuerer/repos","events_url":"https://api.github.com/users/anfuerer/events{/privacy}","received_events_url":"https://api.github.com/users/anfuerer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-12T09:58:41Z","updated_at":"2015-02-12T09:58:41Z","closed_at":null,"body":"We see repeated traffic from a Google IP (looks like it's the google bot) to /auth/authenticate using invalid  or outdated session ids. Securesocial responds with a `500 Internal Server Error` and always logs an exception in the log:\r\n\r\n```\r\n[error] s.c.p.GoogleProvider - [securesocial] missing sid in session.\r\n[error] application - \r\n\r\n! @6l6l2defd - Internal server error, for (GET) [/auth/authenticate/google?state=123&code=456] ->\r\n\r\nplay.api.Application$$anon$1: Execution exception[[AuthenticationException: null]]\r\n\tat play.api.Application$class.handleError(Application.scala:296) ~[play_2.11-2.3.7.jar:2.3.7]\r\n\tat play.api.DefaultApplication.handleError(Application.scala:402) [play_2.11-2.3.7.jar:2.3.7]\r\n\tat play.core.server.netty.PlayDefaultUpstreamHandler$$anonfun$14$$anonfun$apply$1.applyOrElse(PlayDefaultUpstreamHandler.scala:205) [play_2.11-2.3.7.jar:2.3.7]\r\n\tat play.core.server.netty.PlayDefaultUpstreamHandler$$anonfun$14$$anonfun$apply$1.applyOrElse(PlayDefaultUpstreamHandler.scala:202) [play_2.11-2.3.7.jar:2.3.7]\r\n\tat scala.runtime.AbstractPartialFunction.apply(AbstractPartialFunction.scala:36) [scala-library-2.11.1.jar:na]\r\nCaused by: securesocial.core.AuthenticationException: null\r\n\tat securesocial.core.OAuth2Provider$$anonfun$authenticate$1$$anonfun$7.apply(OAuth2Provider.scala:124) ~[classes/:na]\r\n\tat securesocial.core.OAuth2Provider$$anonfun$authenticate$1$$anonfun$7.apply(OAuth2Provider.scala:122) ~[classes/:na]\r\n\tat scala.Option.getOrElse(Option.scala:120) ~[scala-library-2.11.1.jar:na]\r\n\tat securesocial.core.OAuth2Provider$$anonfun$authenticate$1.apply(OAuth2Provider.scala:121) ~[classes/:na]\r\n\tat securesocial.core.OAuth2Provider$$anonfun$authenticate$1.apply(OAuth2Provider.scala:110) ~[classes/:na]\r\n```\r\n\r\nIn my opinion this should not trigger a 500, but should be rejected as an invalid request (without exception logging). I would expect sth like a `401 Unauthorized` or a `400 Bad Request` "}}