ory/hydra · error

unable to base64 decode the location

Error message

unable to base64 decode the location

What it means

Returned by readFile in strict base64 mode (WithDisabledResilientBase64Loader set) when the payload after base64:// fails standard base64 decoding. The encoded payload contains invalid characters, wrong padding, or line breaks that strict StdEncoding rejects; the resilient RawStdEncoding path that tolerates some of these is disabled.

Source

Thrown at oryx/osx/file.go:197

		resp, err := o.hc.Get(parsed.String())
		if err != nil {
			return nil, errors.Wrap(err, "unable to load remote file")
		}
		defer resp.Body.Close()

		bytes, err = io.ReadAll(resp.Body)
		if err != nil {
			return nil, errors.Wrap(err, "unable to read the HTTP response body")
		}
	case "base64":
		if o.disableBase64Loader {
			return nil, errors.New("base64 loader disabled")
		}

		if o.disableResilientBase64Loader {
			bytes, err = o.base64enc.DecodeString(strings.TrimPrefix(source, "base64://"))
			if err != nil {
				return nil, errors.Wrap(err, "unable to base64 decode the location")
			}
			return bytes, nil
		}

		for _, enc := range []*base64.Encoding{
			base64.StdEncoding,
			base64.URLEncoding,
			base64.RawURLEncoding,
			base64.RawStdEncoding,
		} {
			bytes, err = enc.DecodeString(strings.TrimPrefix(source, "base64://"))
			if err == nil {
				return bytes, nil
			}
		}

		return nil, errors.Wrap(err, "unable to base64 decode the location")
	default:

View on GitHub (pinned to 4174065ffb)

Solutions

1. Re-encode the payload with standard base64 (padding included, no newlines)
2. Remove whitespace/newlines from the embedded base64 string
3. Re-enable the resilient base64 loader if the source cannot be re-encoded

When it happens

Trigger: Thrown at oryx/osx/file.go:197 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/923ea5c6c8045291. Report an issue: GitHub.