gofr-dev/gofr · error

response body is empty

Error message

response body is empty

What it means

errEmptyResponseBody is returned by getPublicKeys when the HTTP response fetched from the provider's JWKS/certs endpoint has an empty body. Without a body there are no keys to parse, so the middleware aborts key retrieval. It guards against silent upstream failures (e.g. a 200 with zero bytes).

Source

Thrown at pkg/gofr/http/middleware/oauth.go:26

	"errors"
	"fmt"
	"io"
	"math/big"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	errEmptyProvider       = errors.New("require non-empty provider")
	errInvalidInterval     = errors.New("invalid interval, require a value greater than 1 second")
	errEmptyModulus        = errors.New("modulus is empty")
	errEmptyPublicExponent = errors.New("public exponent is empty")
	errEmptyResponseBody   = errors.New("response body is empty")
	errInvalidURL          = errors.New("invalid URL")
)

const jwtRegexPattern = "^[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+$"

// PublicKeys stores a map of public keys identified by their key ID (kid).
type PublicKeys struct {
	mu   sync.RWMutex
	keys map[string]*rsa.PublicKey
}

// JWKNotFound is an error type indicating a missing JSON Web Key Set (JWKS).
type JWKNotFound struct {
}

func (JWKNotFound) Error() string {
	return "JWKS Not Found"
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Curl the configured JWKS URL and confirm a non-empty JSON key set is returned
2. Correct the provider URL / certs endpoint configuration
3. Retry the request; if behind a proxy, bypass it or whitelist the auth domain

Example fix

// before
provider: "https://wrong-host.example.com"
// after
provider: "https://auth.example.com/.well-known/jwks.json"

resp, _ := http.Get(jwksURL); if resp.StatusCode != 200 || resp.ContentLength == 0 { return errors.New("empty JWKS response") }

func isNonEmptyBody(b []byte) bool { return len(b) > 0 }

keys, err := getPublicKeys(...); if err != nil { log.Printf("JWKS fetch failed: %v", err); http.Error(w, "auth unavailable", http.StatusServiceUnavailable); return }

When it happens

Trigger: The JWKS URL returns an empty 200 response; a proxy/load balancer strips or truncates the body; network middleware interferes with the response.

Common situations: Corporate proxies returning empty bodies on auth endpoints; misconfigured provider URL pointing at a page that returns nothing; intermittent network issues in CI.

Related errors

• modulus is empty
• public exponent is empty
• Could not open WebSocket connection
• %w: creating index: %w
• %w: deleting index: %w

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/4a8386799267186f. Report an issue: GitHub.