ory/hydra · error

server_error

server_error

Error message

{"error":"server_error","error_description":"%s"}

What it means

In WritePushedAuthorizeError, this format string renders the non-debug fallback body for a PAR error: a JSON server_error whose error_description is filled only when debug messages are exposed to clients, otherwise a generic message is sent. It fires when writing the RFC6749-mapped error for a failed pushed-authorize request.

Source

Thrown at fosite/pushed_authorize_response_writer.go:86

	rw.WriteHeader(http.StatusCreated)
	_, _ = rw.Write(js)
}

// WritePushedAuthorizeError writes the PAR error
func (f *Fosite) WritePushedAuthorizeError(ctx context.Context, rw http.ResponseWriter, ar AuthorizeRequester, err error) {
	rw.Header().Set("Cache-Control", "no-store")
	rw.Header().Set("Pragma", "no-cache")
	rw.Header().Set("Content-Type", "application/json;charset=UTF-8")

	sendDebugMessagesToClient := f.Config.GetSendDebugMessagesToClients(ctx)
	rfcerr := ErrorToRFC6749Error(err).WithLegacyFormat(f.Config.GetUseLegacyErrorFormat(ctx)).
		WithExposeDebug(sendDebugMessagesToClient).WithLocalizer(f.Config.GetMessageCatalog(ctx), getLangFromRequester(ar))

	js, err := json.Marshal(rfcerr)
	if err != nil {
		if sendDebugMessagesToClient {
			errorMessage := EscapeJSONString(err.Error())
			http.Error(rw, fmt.Sprintf(`{"error":"server_error","error_description":"%s"}`, errorMessage), http.StatusInternalServerError)
		} else {
			http.Error(rw, `{"error":"server_error"}`, http.StatusInternalServerError)
		}
		return
	}

	rw.WriteHeader(rfcerr.CodeField)
	_, _ = rw.Write(js)
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Keep sendDebugMessagesToClient disabled in production so internals are not leaked
2. Map underlying errors to specific RFC6749 error codes before they reach this writer
3. Log the full error server-side while returning the generic description to the client

When it happens

Trigger: Thrown at fosite/pushed_authorize_response_writer.go:86 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/0ef77807b9fb5ad8. Report an issue: GitHub.