Why does the Membrane OAuth2 login dialog return 500 Internal Server Error?

The oauth2authserver plugin failed while it handled a request to its login dialog, for example because location or consentFile is not configured, a form parameter was sent twice, or the consent parameter was missing.

Why does the response contain no details?

For this error Membrane always hides the details, even in development mode. The response contains no link to this page and no exception message. The stack trace is written to the gateway log.

How do I enable the login dialog of the Membrane authorization server?

Configure both location and consentFile on the oauth2authserver plugin. Without them the login dialog is disabled, and Membrane warns about it at startup.

500 Internal Server Error: OAuth2 Login Dialog Failed

Membrane API Gateway returns a bare 500 Internal Server Error when the login dialog of the oauth2authserver plugin fails while it handles the login form, the consent page, the logout or a static resource of the dialog. The client's input or the configuration of the authorization server is usually to blame.

The Error Response

The response contains the status 500 Internal Server Error, the title Internal Server Error and the problem type https://membrane-api.io/problems/internal. The type internal means that the gateway could not complete the processing of the exchange. Membrane hides the details of this error in every mode: the response does not contain a link to this page, the exception message or a stack trace. You find this page through the log or a search.

What the Login Dialog Does

With the authorization code or implicit flow, the oauth2authserver plugin shows a login dialog to the user. Requests under its path are handled by this dialog: it renders the login form from the templates in location, asks for consent with the page from consentFile, and handles the logout. If handling such a request throws an exception, the gateway answers with this error. For the flows in general, see the authorization code flow tutorial.

Common Causes

The Login Dialog Is Not Configured

If location or consentFile is missing, the login dialog is disabled. When a client with a session then requests a URL under path, the missing dialog leads to an exception. Membrane warns about the missing setting at startup.

A Form Parameter Is Repeated or Malformed

The login dialog parses the query string and form parameters strictly. A parameter that occurs more than once, or an invalid percent-escape, is rejected.

The Consent Parameter Is Missing

A POST to the consent page must contain the consent form parameter.

The Request or the Dialog Page Is Broken

The request URI cannot be parsed, the form body could not be read, or a page template of the dialog could not be rendered.

How to Fix It

Gateway operator: configure both location and consentFile on oauth2authserver if you use the authorization code or implicit flow.
Client side: submit the login and consent forms as the dialog provides them.
Check the gateway log for the stack trace logged at the time of the request. If it points to an internal error, report it on GitHub Issues.

Find the Details in the Log

For this error, Membrane always behaves as in production mode, even when the gateway runs in development mode. The response contains only the status, the title Internal Server Error, the type https://membrane-api.io/problems/internal and, if an exception was recorded, a log key. It never contains a link to this page or the exception message. Search the gateway log for the log key, or for the stack trace logged at error level at the time of the request, to find the cause.