ory/hydra · error

{"error": "%s"}

Error message

{"error": "%s"}

What it means

In WriteRevocationResponse, this format renders the JSON body for a revocation error: {"error": "%s"} with the RFC6749 error code. Per RFC 7009, invalid tokens intentionally do not reach this path (they yield 200); only malformed requests or server errors produce this body, with the specific code chosen by error type.

Source

Thrown at fosite/revoke_handler.go:102

// Note: invalid tokens do not cause an error response since the client
// cannot handle such an error in a reasonable way.  Moreover, the
// purpose of the revocation request, invalidating the particular token,
// is already achieved.
func (f *Fosite) WriteRevocationResponse(ctx context.Context, rw http.ResponseWriter, err error) {
	rw.Header().Set("Cache-Control", "no-store")
	rw.Header().Set("Pragma", "no-cache")

	if err == nil {
		rw.WriteHeader(http.StatusOK)
		return
	}

	if errors.Is(err, ErrInvalidRequest) {
		rw.Header().Set("Content-Type", "application/json;charset=UTF-8")

		js, err := json.Marshal(ErrInvalidRequest)
		if err != nil {
			http.Error(rw, fmt.Sprintf(`{"error": "%s"}`, err.Error()), http.StatusInternalServerError)
			return
		}

		rw.WriteHeader(ErrInvalidRequest.CodeField)
		_, _ = rw.Write(js)
	} else if errors.Is(err, ErrInvalidClient) {
		rw.Header().Set("Content-Type", "application/json;charset=UTF-8")

		js, err := json.Marshal(ErrInvalidClient)
		if err != nil {
			http.Error(rw, fmt.Sprintf(`{"error": "%s"}`, err.Error()), http.StatusInternalServerError)
			return
		}

		rw.WriteHeader(ErrInvalidClient.CodeField)
		_, _ = rw.Write(js)
	} else {
		// 200 OK

View on GitHub (pinned to 4174065ffb)

Solutions

1. Return 200 for invalid/unrecognized tokens per RFC 7009 section 2.2
2. Map errors to proper RFC6749 codes (unsupported_token_type, invalid_request, server_error)
3. Ensure no token-identifying information leaks in the error body

When it happens

Trigger: Thrown at fosite/revoke_handler.go:102 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/e60af7927bbb5570. Report an issue: GitHub.