ory/kratos · error

empty response provided from the webhook

Error message

empty response provided from the webhook

What it means

parseWebhookResponse received a nil *http.Response when inspecting the webhook's reply. This is a nil guard against a programming-level contract violation - the dispatch code should always hand a non-nil response - rather than anything the webhook server returned.

Solutions

1. Ensure the webhook dispatch path always returns a response object before parsing
2. Add a nil check at the call site to fail fast with clearer context
3. Report the inconsistency if it stems from library code rather than local wiring

When it happens

Trigger: Thrown at selfservice/hook/web_hook.go:457 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/01727ce08a232b30. Report an issue: GitHub.

Appendix: source

Thrown at selfservice/hook/web_hook.go:457

	return nil
}

// RemoveDisallowedHeaders removes all headers from httpHeaders that are not in
// headerAllowlist.
func RemoveDisallowedHeaders(httpHeaders http.Header, headerAllowlist []string) http.Header {
	res := make(http.Header, len(headerAllowlist))
	for _, allowed := range headerAllowlist {
		allowed = textproto.CanonicalMIMEHeaderKey(allowed)
		if h, ok := httpHeaders[allowed]; ok {
			res[allowed] = h
		}
	}
	return res
}

func parseWebhookResponse(resp *http.Response, id *identity.Identity) (err error) {
	if resp == nil {
		return errors.Errorf("empty response provided from the webhook")
	}

	if resp.StatusCode == http.StatusOK {
		type localIdentity identity.Identity
		var hookResponse struct {
			Identity *localIdentity `json:"identity"`
		}
		// io.ReadAll is safe, because resp.Body is already a limited reader.
		body, err := io.ReadAll(resp.Body)
		if err != nil {
			return errors.Wrap(err, "webhook response body could not be read")
		}
		if err = json.Unmarshal(body, &hookResponse); err != nil {
			return errors.Wrap(err, "webhook response could not be unmarshalled properly from JSON")
		}

		if hookResponse.Identity == nil {
			return nil

View on GitHub (pinned to b86338da04)