ory/hydra · error

err.Error()

Error message

err.Error()

What it means

In WritePushedAuthorizeResponse, this is the fallback branch when json.Marshal of the PAR response map fails: the pushed-authorization-response payload cannot be serialized, and the raw error text is written as an HTTP error. Practically unreachable for map[string]interface{} data, it guards against internal state producing unmarshalable values.

Source

Thrown at fosite/pushed_authorize_response_writer.go:62

	return resp, nil
}

// WritePushedAuthorizeResponse writes the PAR response
func (f *Fosite) WritePushedAuthorizeResponse(ctx context.Context, rw http.ResponseWriter, ar AuthorizeRequester, resp PushedAuthorizeResponder) {
	// Set custom headers, e.g. "X-MySuperCoolCustomHeader" or "X-DONT-CACHE-ME"...
	wh := rw.Header()
	rh := resp.GetHeader()
	for k := range rh {
		wh.Set(k, rh.Get(k))
	}

	wh.Set("Cache-Control", "no-store")
	wh.Set("Pragma", "no-cache")
	wh.Set("Content-Type", "application/json;charset=UTF-8")

	js, err := json.Marshal(resp.ToMap())
	if err != nil {
		http.Error(rw, err.Error(), http.StatusInternalServerError)
		return
	}

	rw.Header().Set("Content-Type", "application/json;charset=UTF-8")

	rw.WriteHeader(http.StatusCreated)
	_, _ = rw.Write(js)
}

// WritePushedAuthorizeError writes the PAR error
func (f *Fosite) WritePushedAuthorizeError(ctx context.Context, rw http.ResponseWriter, ar AuthorizeRequester, err error) {
	rw.Header().Set("Cache-Control", "no-store")
	rw.Header().Set("Pragma", "no-cache")
	rw.Header().Set("Content-Type", "application/json;charset=UTF-8")

	sendDebugMessagesToClient := f.Config.GetSendDebugMessagesToClients(ctx)
	rfcerr := ErrorToRFC6749Error(err).WithLegacyFormat(f.Config.GetUseLegacyErrorFormat(ctx)).
		WithExposeDebug(sendDebugMessagesToClient).WithLocalizer(f.Config.GetMessageCatalog(ctx), getLangFromRequester(ar))

View on GitHub (pinned to 4174065ffb)

Solutions

1. Return a proper 500 server_error JSON body instead of plain-text http.Error
2. Log the marshal failure with the response map contents for diagnosis
3. Ensure responder ToMap implementations only return JSON-safe values

When it happens

Trigger: Thrown at fosite/pushed_authorize_response_writer.go:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/65f148625e33e17c. Report an issue: GitHub.