500 Internal Server Error: Error Handling Response in OAuth2 Resource

Membrane API Gateway returns 500 Internal Server Error with the detail Error handling response! when the OAuth2 client plugin oauth2Resource2 cannot store its session in the response.

The Error Response

The response contains the status 500 Internal Server Error, the detail Error handling response!, the problem type https://membrane-api.io/problems/internal and a link to this page. The type internal means that the gateway could not complete the processing of the message. In production mode, the title is replaced by Internal Server Error and the details are left out.

What Happens in the Response Flow

The oauth2Resource2 plugin keeps the login in a session. It does nothing else in the response flow: there, the session manager stores the session and sets the session cookie with a Set-Cookie header. This error means that this step failed, so the cause is the session configuration or its environment.

Common Causes

The Session Could Not Be Persisted

The log reads The newly created session could not be persisted in the Set-Cookie header. A remote session store such as Redis or Memcached is unreachable or rejected the write.

The Session Cookie Could Not Be Created

The cookie value could not be created, for example because a JWT-based session manager could not sign the session.

How to Fix It

1. Look up the root cause in the gateway log. In production, use the log key of the response to find it.
2. Check that the backend of the configured session manager is reachable, and that its keys or credentials are valid.
3. If the session configuration is correct, report the problem with the stack trace on GitHub Issues.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---. The title then reads Internal Server Error, and the details and the link to this page are left out. If the response contains a log key, search the gateway log for it to find the full error message.

Related Documentation

Configuration reference:

• oauth2Resource2

Tutorials with runnable examples:

• OAuth2 Basics

← All Membrane error messages