{"record":{"id":"01727ce08a232b30","repo":"ory/kratos","slug":"empty-response-provided-from-the-webhook","errorCode":null,"errorMessage":"empty response provided from the webhook","messagePattern":"empty response provided from the webhook","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"selfservice/hook/web_hook.go","lineNumber":457,"sourceCode":"\treturn nil\n}\n\n// RemoveDisallowedHeaders removes all headers from httpHeaders that are not in\n// headerAllowlist.\nfunc RemoveDisallowedHeaders(httpHeaders http.Header, headerAllowlist []string) http.Header {\n\tres := make(http.Header, len(headerAllowlist))\n\tfor _, allowed := range headerAllowlist {\n\t\tallowed = textproto.CanonicalMIMEHeaderKey(allowed)\n\t\tif h, ok := httpHeaders[allowed]; ok {\n\t\t\tres[allowed] = h\n\t\t}\n\t}\n\treturn res\n}\n\nfunc parseWebhookResponse(resp *http.Response, id *identity.Identity) (err error) {\n\tif resp == nil {\n\t\treturn errors.Errorf(\"empty response provided from the webhook\")\n\t}\n\n\tif resp.StatusCode == http.StatusOK {\n\t\ttype localIdentity identity.Identity\n\t\tvar hookResponse struct {\n\t\t\tIdentity *localIdentity `json:\"identity\"`\n\t\t}\n\t\t// io.ReadAll is safe, because resp.Body is already a limited reader.\n\t\tbody, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"webhook response body could not be read\")\n\t\t}\n\t\tif err = json.Unmarshal(body, &hookResponse); err != nil {\n\t\t\treturn errors.Wrap(err, \"webhook response could not be unmarshalled properly from JSON\")\n\t\t}\n\n\t\tif hookResponse.Identity == nil {\n\t\t\treturn nil","sourceCodeStart":439,"sourceCodeEnd":475,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/selfservice/hook/web_hook.go#L439-L475","documentation":"parseWebhookResponse received a nil *http.Response when inspecting the webhook's reply. This is a nil guard against a programming-level contract violation - the dispatch code should always hand a non-nil response - rather than anything the webhook server returned.","triggerScenarios":"Thrown at selfservice/hook/web_hook.go:457 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the webhook dispatch path always returns a response object before parsing","Add a nil check at the call site to fail fast with clearer context","Report the inconsistency if it stems from library code rather than local wiring"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}