{"record":{"id":"a804d86c26e3a093","repo":"ory/hydra","slug":"err-error","errorCode":null,"errorMessage":"err.Error()","messagePattern":"err\\.Error\\(\\)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"warning","filePath":"cmd/cmd_perform_authorization_code.go","lineNumber":382,"sourceCode":"\tdefer raw.Body.Close() //nolint:errcheck\n\n\tif rt.skip && req.GetSkip() {\n\t\treq, res, err := rt.cl.OAuth2API.AcceptOAuth2LoginRequest(r.Context()).\n\t\t\tLoginChallenge(req.Challenge).\n\t\t\tAcceptOAuth2LoginRequest(openapi.AcceptOAuth2LoginRequest{Subject: req.Subject}).\n\t\t\tExecute()\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tdefer res.Body.Close() //nolint:errcheck\n\t\thttp.Redirect(w, r, req.RedirectTo, http.StatusFound)\n\t\treturn\n\t}\n\n\tpretty, err := prettyJSON(raw.Body)\n\tif err != nil {\n\t\thttp.Error(w, err.Error(), http.StatusInternalServerError)\n\t\treturn\n\t}\n\t_ = tokenUserLogin.Execute(w, struct {\n\t\tLoginChallenge string\n\t\tSkip           bool\n\t\tSessionID      string\n\t\tRaw            string\n\t}{\n\t\tLoginChallenge: req.Challenge,\n\t\tSkip:           req.GetSkip(),\n\t\tSessionID:      req.GetSessionId(),\n\t\tRaw:            pretty,\n\t})\n}\n\nfunc (rt *router) loginPOST(w http.ResponseWriter, r *http.Request) {\n\tif err := r.ParseForm(); err != nil {\n\t\thttp.Error(w, err.Error(), http.StatusBadRequest)","sourceCodeStart":364,"sourceCodeEnd":400,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/cmd/cmd_perform_authorization_code.go#L364-L400","documentation":"In the `hydra perform authorization-code` CLI's loginGET handler, the raw login request body returned by the Hydra Admin API (GetOAuth2LoginRequest) is pretty-printed via prettyJSON before being rendered into the tokenUserLogin HTML template. If reading/pretty-printing that JSON body fails, the CLI responds with HTTP 500 and err.Error() — the prettyJSON/JSON-decoding error message (e.g. \"unexpected EOF\", \"invalid character ...\"). The displayed text is the underlying parse error, not a structured error type.","triggerScenarios":"The admin API response body was truncated/corrupted (connection closed mid-response, proxy buffering issues), the body was already consumed or closed before prettyJSON read it, or the response is not valid JSON (HTML error page from an intermediary).","commonSituations":"Running the CLI behind a corporate proxy that rewrites responses; Hydra endpoint returning an error page instead of JSON; Go HTTP client timeouts cutting the body; raw.Body read twice (once for parse, once for pretty).","solutions":["Check the CLI logs/curl the admin endpoint directly to see the actual response body; fix the upstream response (correct endpoint URL).","Ensure the admin URL is the Hydra admin port (e.g. :4445) and not a public port or UI behind an HTML-serving proxy.","Retry the flow; if it is a flaky proxy/timeouts, disable intermediaries or increase timeouts.","In code, close the body only after prettyJSON has read it and log the body when parsing fails for diagnosis."],"exampleFix":"// before\ndefer raw.Body.Close()\npretty, err := prettyJSON(raw.Body)\nif err != nil {\n    http.Error(w, err.Error(), http.StatusInternalServerError)\n}\n// after\npretty, rawBody, err := prettyJSON(raw.Body)\nif err != nil {\n    log.Printf(\"failed to parse login response %q: %v\", rawBody, err)\n    http.Error(w, \"failed to render login page\", http.StatusInternalServerError)\n    return\n}\ndefer raw.Body.Close()","handlingStrategy":"try-catch","validationCode":"// verify the admin endpoint returns JSON before driving the CLI flow\ncurl -s -f \"$ADMIN_URL/admin/oauth2/auth/requests/login?login_challenge=...\" | jq . >/dev/null || echo \"non-JSON response\"","typeGuard":null,"tryCatchPattern":"if pretty, err := prettyJSON(raw.Body); err != nil {\n    log.Printf(\"prettyJSON failed: %v\", err)\n    http.Error(w, \"failed to render login page\", http.StatusInternalServerError)\n    return\n}","preventionTips":["Point the CLI at the Hydra admin endpoint (:4445) directly, not through HTML-serving proxies.","Log the raw response body whenever JSON parsing fails.","Read/close response bodies exactly once and check truncation (io.ReadAll error) before parsing."],"tags":["http","json","cli","oryx"],"backgroundTag":"invalid-json-response","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}