{"record":{"id":"6fb7a721deabba7e","repo":"oauth2-proxy/oauth2-proxy","slug":"unable-to-unmarshal-raw-response-body-w","errorCode":null,"errorMessage":"unable to unmarshal raw response body: %w","messagePattern":"unable to unmarshal raw response body: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"providers/ms_entra_id.go","lineNumber":318,"sourceCode":"\t\t}\n\t}\n\treturn false\n}\n\nfunc (p *MicrosoftEntraIDProvider) fetchToken(ctx context.Context, params url.Values) (*oauth2.Token, error) {\n\tresp := requests.New(p.RedeemURL.String()).\n\t\tWithContext(ctx).\n\t\tWithMethod(http.MethodPost).\n\t\tWithBody(bytes.NewBufferString(params.Encode())).\n\t\tSetHeader(\"Content-Type\", \"application/x-www-form-urlencoded\").\n\t\tDo()\n\n\tvar token *oauth2.Token\n\tvar rawResponse interface{}\n\n\tbody := resp.Body()\n\tif err := json.Unmarshal(body, &rawResponse); err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to unmarshal raw response body: %w\", err)\n\t}\n\n\tif err := json.Unmarshal(body, &token); err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to unmarshal token response body: %w\", err)\n\t}\n\n\treturn token.WithExtra(rawResponse), nil\n}\n","sourceCodeStart":300,"sourceCodeEnd":327,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/providers/ms_entra_id.go#L300-L327","documentation":"fetchToken parses the token endpoint's HTTP response body. It first unmarshals the body into a generic interface to keep the raw response (for oauth2 token extras). This error is thrown when the body is not valid JSON, wrapping the json.Unmarshal error.","triggerScenarios":"fetchToken (called from redeemWithFederatedToken / redeemRefreshTokenWithFederatedToken) receives a response body that is not valid JSON: HTML error pages from proxies/gateways, empty bodies, or plain-text errors from Azure AD or an intercepting middlebox.","commonSituations":"Corporate proxy or WAF returning an HTML block page; Azure AD returning a non-JSON error; wrong token endpoint URL hitting a login page; TLS-terminating appliance injecting content.","solutions":["Log the actual response body (the wrapped %w error includes the JSON syntax detail) to see what came back","Check for a corporate proxy/WAF intercepting requests to login.microsoftonline.com and add an exception","Verify the configured token endpoint URL points at the real OAuth2 token endpoint","Retry — transient gateway errors can return truncated/empty bodies"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: check connectivity through your proxy to the token endpoint\nreq, _ := http.NewRequest(\"POST\", tokenURL, nil)\nresp, err := http.DefaultClient.Do(req)\nif err == nil && strings.Contains(http.DetectContentType(peerBody(resp)), \"text/html\") {\n    log.Println(\"proxy/WAF returned HTML instead of JSON\")\n}","typeGuard":null,"tryCatchPattern":"if err := provider.RefreshSession(ctx, sess); err != nil {\n    if strings.Contains(err.Error(), \"unable to unmarshal raw response body\") {\n        // body wasn't JSON (proxy page, empty body): retry after backoff, then alert\n    }\n}","preventionTips":["Exempt login.microsoftonline.com from corporate proxy/WAF interception","Monitor for non-JSON responses from the token endpoint","Use plain-text logging of response content-type on failures","Retry transient gateway errors with backoff before surfacing to the user"],"tags":["entra-id","json","http-response","token-endpoint"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}