ory/hydra · warning

Failed to parse form: %s

Error message

Failed to parse form: %s

What it means

POSTdevice parses the submitted form before reading the user code and device challenge. If r.ParseForm() fails (malformed body, unsupported content type), the handler responds 400 with 'Failed to parse form: <err>'.

Source

Thrown at cmd/cmd_perform_device_flow.go:175

func (s *deviceSrv) GETdevice(w http.ResponseWriter, r *http.Request) {
	if r.URL.Query().Get("device_challenge") == "" {
		http.Error(w, "device_challenge is required", http.StatusBadRequest)
		return
	}

	err := userCodeTemplate.Execute(w, userCodeData{
		UserCode:        r.URL.Query().Get("user_code"),
		DeviceChallenge: r.URL.Query().Get("device_challenge"),
	})
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to render template: %s", err), http.StatusInternalServerError)
		return
	}
}

func (s *deviceSrv) POSTdevice(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		http.Error(w, fmt.Sprintf("Failed to parse form: %s", err), http.StatusBadRequest)
		return
	}
	userCode, challenge := r.FormValue("user_code"), r.FormValue("device_challenge")
	if userCode == "" {
		http.Error(w, "user_code is required", http.StatusBadRequest)
		return
	}
	if challenge == "" {
		http.Error(w, "device_challenge is required", http.StatusBadRequest)
		return
	}

	// Accept the user code with a hand-rolled request instead of the generated
	// client: other modules in this repository compile this package against the
	// released hydra-client-go/v2 module, which predates the device
	// authorization API.
	cfg := s.cl.GetConfig()
	if len(cfg.Servers) == 0 {

View on GitHub (pinned to 4174065ffb)

Solutions

1. POST application/x-www-form-urlencoded fields user_code and device_challenge
2. Verify Content-Type header is application/x-www-form-urlencoded
3. Inspect the raw body for truncation or encoding issues
4. Test with the normal HTML form from the device page to confirm baseline behavior

Example fix

// before
curl -X POST http://localhost:4445/device -H 'Content-Type: application/json' -d '{"user_code":"1234"}'
// after
curl -X POST http://localhost:4445/device -d 'user_code=1234&device_challenge=abc'

// client side
requests.post(url, data={"user_code": code, "device_challenge": ch},
              headers={"Content-Type": "application/x-www-form-urlencoded"})

When it happens

Trigger: Submitting the device user-code form with a corrupted or non-urlencoded body, or a client POSTing JSON/multipart to this endpoint.

Common situations: Manual curl tests with wrong content type; browser extensions or proxies altering the form body; custom automation posting JSON instead of urlencoded fields.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• device_challenge is required
• Failed to render template: %s
• user_code is required
• header, body and signature must all be set
• errKeyNotFound

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/0a707f6f7bb90f48. Report an issue: GitHub.