Why does the Membrane OAuth2 authorization server return 500 for an unknown endpoint?

Requests to paths the oauth2authserver does not serve are normally answered with an invalid_request error. A 500 means that creating this small JSON error response failed, which does not happen in normal operation and indicates a bug in Membrane.

How do I fix a 500 from the Membrane OAuth2 default endpoint?

Check that the client uses the correct authorization server endpoint paths, look for the exception in the gateway log, and report it with the stack trace on GitHub Issues.

500 Internal Server Error: OAuth2 Default Endpoint Failure

Membrane API Gateway uses this page for a 500 Internal Server Error of its OAuth2 authorization server (oauth2authserver) that occurs when the server fails to answer a request for an endpoint it does not serve. This does not happen in normal operation and usually indicates a bug in Membrane.

The Error Response

The client receives the status 500 Internal Server Error with the title Internal Server Error and the problem type https://membrane-api.io/problems/internal. The type internal means that the gateway could not complete the processing of the request. For this error, Membrane always behaves as in production mode: the response contains no details and no link to this page, regardless of the gateway's configuration. The cause can only be found in the gateway log.

What the Default Endpoint Does

The oauth2authserver plugin serves a fixed set of endpoints, such as the authorization, token and user info endpoints. Every request for another path under the server is answered with a standard OAuth2 error, a small JSON document {"error": "invalid_request"}. Only if creating that document fails is this 500 returned.

Common Causes

Creating the invalid_request Response Failed

Serializing the invalid_request JSON response failed because of an unexpected internal state. No realistic trigger is known for this case, so treat it as a bug in Membrane.

How to Fix It

Check the gateway log. Membrane logs the full exception at error level.
Report the problem with the stack trace on GitHub Issues.
Client side: requests to unknown authorization server paths normally get an invalid_request error. Check that the client uses the correct endpoint paths.

For a working setup of the authorization server and a client, see the authorization code flow tutorial.

Details in Production Mode

Unlike most other errors, this one never includes details, the exception message or a link to this page in the response, not even in development mode. You do not need to configure anything to hide them. To analyze the error, use the gateway log.