{"record":{"id":"237668645fb0262a","repo":"docker/cli","slug":"failed-to-decode-response-w","errorCode":null,"errorMessage":"failed to decode response: %w","messagePattern":"failed to decode response: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/oauth/api/api.go","lineNumber":184,"sourceCode":"\t\t\"device_code\": {state.DeviceCode},\n\t}\n\toauthTokenURL := a.TenantURL + \"/oauth/token\"\n\n\tresp, err := postForm(ctx, oauthTokenURL, strings.NewReader(data.Encode()))\n\tif err != nil {\n\t\treturn TokenResponse{}, fmt.Errorf(\"failed to get tokens: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = resp.Body.Close()\n\t}()\n\n\t// this endpoint returns a 403 with an `authorization_pending` error until the\n\t// user has authenticated, so we don't check the status code here and instead\n\t// decode the response and check for the error.\n\tvar res TokenResponse\n\terr = json.NewDecoder(resp.Body).Decode(&res)\n\tif err != nil {\n\t\treturn res, fmt.Errorf(\"failed to decode response: %w\", err)\n\t}\n\n\treturn res, nil\n}\n\n// RevokeToken revokes a refresh token with the tenant so that it can no longer\n// be used to get new tokens.\nfunc (a API) RevokeToken(ctx context.Context, refreshToken string) error {\n\tdata := url.Values{\n\t\t\"client_id\": {a.ClientID},\n\t\t\"token\":     {refreshToken},\n\t}\n\n\trevokeURL := a.TenantURL + \"/oauth/revoke\"\n\tresp, err := postForm(ctx, revokeURL, strings.NewReader(data.Encode()))\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/api/api.go#L166-L202","documentation":"Returned by getDeviceToken() when json.NewDecoder(resp.Body).Decode(&res) fails. The token endpoint returned an HTTP response (no transport error, status not checked here because 403 authorization_pending is normal) but the body is not valid JSON or does not match TokenResponse.","triggerScenarios":"The OAuth tenant returns HTML/garbage (captive portal, proxy error page, 5xx with text body) instead of the expected JSON token/error document during the device-code grant polling.","commonSituations":"Captive Wi-Fi portal intercepting the POST; reverse proxy returning an HTML error; tenant endpoint changed schema; truncated response from a flaky proxy.","solutions":["Confirm the TenantURL is correct and reachable directly (curl the /oauth/token endpoint).","Bypass captive portals / proxies that rewrite responses to HTML.","Retry the login flow once transient intermediary issues clear.","Update the CLI to match the current Hub OAuth contract."],"exampleFix":"# before: captive portal returns HTML\ndocker login\n# after: connect to real network / configure proxy auth\nwifi-connect trusted-network\ndocker login","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"var se *json.SyntaxError\nvar te *json.UnmarshalTypeError\nswitch {\ncase errors.As(err, &se):  // body not JSON (captive portal)\ncase errors.As(err, &te): // schema mismatch\n}","preventionTips":["Ensure no proxy rewrites the OAuth response body to HTML.","Keep the CLI version aligned with the Hub OAuth schema.","Retry once after moving off captive networks."],"tags":["oauth","docker-hub","json","decode","device-flow","auth"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}