Why does the Membrane /oauth2/revoke endpoint return 500 Internal Server Error?

The revocation endpoint of the oauth2authserver plugin threw an exception while it handled the request. In most cases a parameter was sent twice or contained a malformed percent-escape.

Why does the revocation error response contain no details?

For this error Membrane always hides the details, even in development mode. The response contains no link to this page and no exception message. The stack trace is written to the gateway log.

How do I call the Membrane token revocation endpoint correctly?

Send each of the parameters token, client_id and client_secret once, and percent-encode the values correctly.

500 Internal Server Error: OAuth2 Token Revocation Failed

Membrane API Gateway returns a bare 500 Internal Server Error when the token revocation endpoint of the oauth2authserver plugin throws an exception while it handles a request. In most cases the client sent parameters the endpoint cannot parse.

The Error Response

The response contains the status 500 Internal Server Error, the title Internal Server Error and the problem type https://membrane-api.io/problems/internal. The type internal means that the gateway could not complete the processing of the exchange. Membrane hides the details of this error in every mode: the response does not contain a link to this page, the exception message or a stack trace. You find this page through the log or a search.

What the Revocation Endpoint Does

The oauth2authserver plugin offers a revocation endpoint at <path>/oauth2/revoke. A client sends it a token together with its client_id and client_secret, and the authorization server invalidates the token and its session. The parameters are read from the query string or an application/x-www-form-urlencoded body. For the flows in general, see the authorization code flow tutorial.

Common Causes

A Parameter Is Repeated

The endpoint parses parameters strictly and rejects duplicates, for example token=a&token=b, with Could not parse query.

A Parameter Contains a Malformed Escape

A value with an invalid percent-escape, for example token=%zz, cannot be URL-decoded.

The Request Cannot Be Read

The request URI cannot be parsed, or the body cannot be read because the client aborted the upload or its Content-Encoding cannot be decoded.

An Unexpected Internal State

If none of the parsing errors above applies, the session handling of the authorization server ran into an unexpected state. This is rare and usually indicates a bug in Membrane.

How to Fix It

Client side: send each parameter (token, client_id, client_secret) once, and percent-encode the values correctly.
Gateway operator: check the gateway log. The full stack trace is logged at error level together with the request.
If the log shows none of the parsing errors above, report it with the stack trace on GitHub Issues.

Find the Details in the Log

For this error, Membrane always behaves as in production mode, even when the gateway runs in development mode. The response contains only the status, the title Internal Server Error, the type https://membrane-api.io/problems/internal and, if an exception was recorded, a log key. It never contains a link to this page or the exception message. Search the gateway log for the log key, or for the stack trace logged at error level at the time of the request, to find the cause.