{"record":{"id":"0abf585597fc61a1","repo":"googleapis/mcp-toolbox","slug":"unexpected-status-d","errorCode":null,"errorMessage":"unexpected status: %d","messagePattern":"unexpected status: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":144,"sourceCode":"\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid auth URL\")\n\t}\n\tif u.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s\", AuthorizationServer)\n\t}\n\n\toidcConfigURL, err := url.JoinPath(AuthorizationServer, \".well-known/openid-configuration\")\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tresp, err := client.Get(oidcConfigURL)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"failed to fetch OIDC config: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"unexpected status: %d\", resp.StatusCode)\n\t}\n\n\t// Limit read size to 1MB to prevent memory exhaustion\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tvar config struct {\n\t\tIssuer                string `json:\"issuer\"`\n\t\tJwksUri               string `json:\"jwks_uri\"`\n\t\tIntrospectionEndpoint string `json:\"introspection_endpoint\"`\n\t}\n\tif err := json.Unmarshal(body, &config); err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tif config.Issuer == \"\" {","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L126-L162","documentation":"The OIDC discovery endpoint responded, but with an HTTP status other than 200 OK. The library treats any non-200 discovery response as fatal because the discovery document was not reliably delivered.","triggerScenarios":"client.Get on .well-known/openid-configuration succeeded but returned e.g. 404 (wrong base URL/path), 403 (blocked), 502/503 (gateway down), or 301/302 (the secure client does not follow redirects, surfacing the redirect status).","commonSituations":"authorizationServer points at the wrong path depth so discovery 404s; auth server redirects http->https or adds a trailing slash and the client refuses to follow; a reverse proxy returns 502 while the auth backend is down.","solutions":["Check the status code in the error message and match it to the cause (404=wrong URL, 403=auth/WAF block, 5xx=server problem)","Verify the authorizationServer base URL is exactly the issuer root (no extra path segments)","Remove trailing-slash or scheme mismatches that cause redirects — the secure client does not follow redirects","Check auth-server/proxy logs for why the discovery route failed"],"exampleFix":"// before (extra path causes 404 on discovery)\nauthorizationServer: \"https://auth.example.com/realms/myrealm/v2\"\n// after\nauthorizationServer: \"https://auth.example.com/realms/myrealm\"","handlingStrategy":"retry","validationCode":"resp, err := http.Get(cfg.AuthorizationServer + \"/.well-known/openid-configuration\")\nif err == nil && resp.StatusCode != 200 {\n    return fmt.Errorf(\"discovery returned %d; check authorizationServer path and redirects\", resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"svc, err := cfg.Initialize()\nif err != nil {\n    var statusErr string\n    if m := regexp.MustCompile(`unexpected status: (\\d+)`).FindStringSubmatch(err.Error()); m != nil {\n        statusErr = m[1]\n    }\n    if statusErr == \"502\" || statusErr == \"503\" {\n        time.Sleep(2 * time.Second) // transient upstream: retry\n    }\n    return err\n}","preventionTips":["Use the exact issuer root as authorizationServer so discovery resolves at the standard path","Avoid http->https or trailing-slash redirects; the secure client does not follow them","Monitor the auth server / reverse proxy health"],"tags":["go","http","oidc","status-code"],"backgroundTag":"unexpected-http-status","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}