{"record":{"id":"d4eeba8f4b082446","repo":"oauth2-proxy/oauth2-proxy","slug":"error-making-request-to-profile-url-v","errorCode":null,"errorMessage":"error making request to profile URL: %v","messagePattern":"error making request to profile URL: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/providers/util/claim_extractor.go","lineNumber":117,"sourceCode":"\t\tWithHeaders(c.requestHeaders).\n\t\tDo()\n\n\t// We first check if the result is a JWT token\n\t// https://openid.net/specs/openid-connect-core-1_0-final.html#UserInfoResponse\n\tmediaType, _, parseErr := mime.ParseMediaType(builder.Headers().Get(\"Content-Type\"))\n\n\tif parseErr == nil && mediaType == \"application/jwt\" {\n\t\t// Decode and use JWT payload as profile claims\n\t\tif pl, err := parseJWT(string(builder.Body())); err == nil {\n\t\t\treturn simplejson.NewJson(pl)\n\t\t}\n\t}\n\n\t// Otherwise, process as normal JSON payload\n\tclaims, err := builder.UnmarshalSimpleJSON()\n\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error making request to profile URL: %v\", err)\n\t}\n\n\treturn claims, nil\n}\n\n// GetClaimInto loads a claim and places it into the destination interface.\n// This will attempt to coerce the claim into the specified type.\n// If it cannot be coerced, an error may be returned.\nfunc (c *claimExtractor) GetClaimInto(claim string, dst any) (bool, error) {\n\tvalue, exists, err := c.GetClaim(claim)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"could not get claim %q: %v\", claim, err)\n\t}\n\tif !exists {\n\t\treturn false, nil\n\t}\n\tif err := util.CoerceClaim(value, dst); err != nil {\n\t\treturn false, fmt.Errorf(\"could not coerce claim: %v\", err)","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/providers/util/claim_extractor.go#L99-L135","documentation":"loadProfileClaims fetches the profile endpoint and unmarshals the response body as JSON via builder.UnmarshalSimpleJSON. When the response body is not parseable JSON (or the builder fails), this error is thrown — the message says 'error making request' but it fires on response decoding failures too.","triggerScenarios":"GetClaim -> loadProfileClaims where the profile endpoint returned a body that cannot be unmarshaled into a simplejson object — e.g. an HTML error page, empty body, or gzip/encoding mismatch.","commonSituations":"IdP returning an HTML login/error page instead of JSON (auth redirect not followed), reverse proxy serving an error page, wrong Content-Type, or a captive portal intercepting the request.","solutions":["Log/inspect the actual response body and status from the profile URL — it is likely HTML or empty, not JSON","Confirm the request carries a valid access token so the endpoint returns JSON instead of an auth-redirect page","Ensure request headers (Accept: application/json) and any proxy/gzip handling are correct","Hit the endpoint with curl -H 'Authorization: Bearer <token>' to compare behavior"],"exampleFix":"// before: no auth header on profile request\nheaders := http.Header{}\n\n// after: pass the access token so the endpoint returns JSON claims\nheaders := http.Header{}\nheaders.Set(\"Authorization\", \"Bearer \"+accessToken)\nextractor, _ := util.NewClaimExtractor(ctx, idToken, profileURL, headers)","handlingStrategy":"try-catch","validationCode":"resp, err := client.Get(profileURL.String())\nif err != nil { return err }\nbody, _ := io.ReadAll(resp.Body)\nif resp.StatusCode != http.StatusOK || !json.Valid(body) {\n    return fmt.Errorf(\"profile endpoint returned non-JSON (status %d)\", resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"claims, err := c.loadProfileClaims()\nif err != nil {\n    return nil, fmt.Errorf(\"error making request to profile URL: %v\", err)\n}","preventionTips":["Send Authorization: Bearer <token> on every profile request so the endpoint returns JSON, not a redirect page","Set Accept: application/json and verify Content-Type on the response","Log response status and first bytes on failure to spot HTML error pages quickly"],"tags":["oidc","http","json","userinfo"],"backgroundTag":"invalid-json-response","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}