{"record":{"id":"e2d7fadf68f8ac34","repo":"wandb/openui","slug":"unexpected-response-r-status-await-r-text","errorCode":null,"errorMessage":"Unexpected response ${r.status}: ${await r.text()}","messagePattern":"Unexpected response (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"frontend/src/api/openui.ts","lineNumber":118,"sourceCode":"\t\tc => c.codePointAt(0) ?? 0\n\t)\nconst asBase64 = (ab: ArrayBuffer | undefined) =>\n\tbtoa(String.fromCodePoint(...new Uint8Array(ab ?? [])))\n\t\t.replaceAll('+', '-')\n\t\t.replaceAll('/', '_')\n\nasync function getPublicKey(username: string, create = false) {\n\tconst r = await fetch(\n\t\t`${API_HOST}/${create ? 'register' : 'auth'}/${encodeURIComponent(\n\t\t\tusername\n\t\t)}`,\n\t\t{\n\t\t\tcredentials: 'same-origin'\n\t\t}\n\t)\n\n\tif (r.status !== 200) {\n\t\tthrow new Error(`Unexpected response ${r.status}: ${await r.text()}`)\n\t}\n\tif (create) {\n\t\treturn (await r.json()) as PublicKeyCredentialCreationOptions\n\t}\n\treturn (await r.json()) as PublicKeyCredentialRequestOptions\n}\n\ninterface AuthResponse {\n\tattestationObject?: ArrayBuffer\n\tclientDataJSON?: ArrayBuffer\n\tsignature?: ArrayBuffer\n\tauthenticatorData?: ArrayBuffer\n}\n\nasync function post(\n\tusername: string,\n\tcreds: PublicKeyCredential,\n\tcreate = false","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/wandb/openui/blob/42d7ab4ab6650433486dfb12eb3783c393a3e475/frontend/src/api/openui.ts#L100-L136","documentation":"getPublicKey() fetches WebAuthn PublicKeyCredential options from the server with same-origin credentials and expects 200. Any other status throws an Error embedding the status and raw response text. It backs both registration (create=true) and authentication flows.","triggerScenarios":"GET of WebAuthn options returning non-200: unauthenticated user requesting auth options, missing/failed session, or server misconfiguration of the relying-party settings.","commonSituations":"Calling the passkey flow without being logged in; server's webauthn endpoint 500s; reverse proxy returns 404/502 HTML which lands in the error text.","solutions":["Ensure the user is authenticated (or correctly anonymous for registration) before requesting options.","Read the status + text in the browser network tab to find the server-side failure.","Verify the backend webauthn route exists and the API_HOST/reverse-proxy config is correct.","Catch this in register/auth and fall back to password auth or a friendly passkey message."],"exampleFix":"// before\nthrow new Error(`Unexpected response ${r.status}: ${await r.text()}`)\n// after\nconst text = await r.text()\nif (r.status === 401) throw new Error('Please log in before using a passkey')\nthrow new Error(`Unexpected response ${r.status}: ${text.slice(0, 200)}`)","handlingStrategy":"try-catch","validationCode":"// ensure same-origin session exists before requesting passkey options\nif (!document.cookie) throw new Error('Login required before passkey flow')","typeGuard":"function isPublicKeyOptions(b: unknown): b is Record<string, unknown> {\n  return typeof b === 'object' && b !== null && ('challenge' in (b as object))\n}","tryCatchPattern":"try {\n  const options = await getPublicKey(username, create)\n} catch (e) {\n  if (String(e).includes('401')) redirectToLogin()\n  else showPasskeyError(e)\n}","preventionTips":["Check session state before starting WebAuthn ceremonies","Verify the backend webauthn route is reachable through any proxy","Always send same-origin credentials on the options fetch"],"tags":["http","webauthn","typescript","authentication"],"backgroundTag":"webauthn-options-fetch-failed","analyzedSha":"42d7ab4ab6650433486dfb12eb3783c393a3e475","analyzedAt":"2026-09-01T05:00:32.200Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}