Issue Station
Sign In
Tools hereToolbox

dify - ✅(Solved) Fix fix(mcp): OAuth discovery functions crash on non-JSON 200 responses [1 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
langgenius/dify#34867•Fetched 2026-04-10 03:45:40
View on GitHub
Comments
1
Participants
1
Timeline
5
Reactions
1
Author
jeanibarzjeanibarz
Participants
jeanibarzjeanibarz
Timeline (top)
closed ×1commented ×1cross-referenced ×1labeled ×1

Error Message

Three OAuth discovery functions in api/core/mcp/auth/auth_flow.py crash when an MCP server returns an HTTP 200 response with a non-JSON body (e.g. an HTML error page, empty body, or malformed JSON). Add json.JSONDecodeError (and IndexError where applicable) to the exception handlers. json is already imported at the top of the file.

Root Cause

The except clauses in all three functions are too narrow:

  • Lines 149, 169: except (RequestError, ValidationError) — missing json.JSONDecodeError
  • Line 279: except RequestError — missing json.JSONDecodeError and IndexError

Fix Action

Fix

Add json.JSONDecodeError (and IndexError where applicable) to the exception handlers. json is already imported at the top of the file.

PR fix notes

PR #34868: fix(mcp): catch JSONDecodeError in OAuth discovery functions 🤖🤖🤖

Description (problem / solution / changelog)

Summary

Three OAuth discovery functions in auth_flow.py crash with unhandled json.JSONDecodeError when an MCP server returns an HTTP 200 response with a non-JSON body (e.g. an HTML page from a reverse proxy, an empty body, or malformed JSON).

Affected functions:

  • discover_protected_resource_metadata() — except clause catches RequestError and ValidationError but not json.JSONDecodeError
  • discover_oauth_authorization_server_metadata() — same
  • check_support_resource_discovery() — except clause only catches RequestError, missing both json.JSONDecodeError and IndexError

Fix: Add the missing exception types to each except clause so non-JSON responses are treated the same as network errors — skip and try the next URL, or return a safe fallback.

Changes

  • api/core/mcp/auth/auth_flow.py: Add json.JSONDecodeError to the two discovery functions' except clauses; add json.JSONDecodeError and IndexError to check_support_resource_discovery()
  • api/tests/unit_tests/core/mcp/auth/test_auth_flow.py: Add tests for non-JSON 200 responses and empty array edge cases in all three functions

Verification

Before fix — a non-JSON 200 response causes:

json.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

propagating up to the caller and crashing the MCP OAuth flow.

After fix — all three functions gracefully handle the error:

  • discover_* functions skip to the next URL and return None if all fail
  • check_support_resource_discovery returns (False, "") and falls back to well-known metadata

All 48 unit tests pass, including the 4 new error-path tests.

Test plan

  • All 48 existing + new unit tests pass (pytest api/tests/unit_tests/core/mcp/auth/test_auth_flow.py)
  • Ruff format clean
  • Ruff lint clean
  • No new type-check errors in changed files

Fixes #34867

Changed files

  • api/core/mcp/auth/auth_flow.py (modified, +3/-3)
  • api/tests/unit_tests/core/mcp/auth/test_auth_flow.py (modified, +35/-0)
RAW_BUFFERClick to expand / collapse

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.14.0 (main branch at commit 985e71e)

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Three OAuth discovery functions in api/core/mcp/auth/auth_flow.py crash when an MCP server returns an HTTP 200 response with a non-JSON body (e.g. an HTML error page, empty body, or malformed JSON).

Affected functions:

  1. discover_protected_resource_metadata() (line 146) — calls response.json() inside a try/except that only catches RequestError and ValidationError, not json.JSONDecodeError

  2. discover_oauth_authorization_server_metadata() (line 166) — same pattern

  3. check_support_resource_discovery() (line 270) — calls response.json() inside a try/except that only catches RequestError; also vulnerable to IndexError if authorization_servers is an empty list

To reproduce: Point an MCP tool at a server whose well-known endpoint returns 200 with HTML content (e.g. a reverse proxy's default page). The discovery function raises an unhandled json.JSONDecodeError instead of gracefully falling back.

Expected Behavior

Discovery functions should treat non-JSON responses the same as network errors — log or skip them and try the next URL (or return None / (False, "") for check_support_resource_discovery).

Actual Behavior

Unhandled json.JSONDecodeError propagates up, crashing the MCP OAuth flow. In check_support_resource_discovery, an empty authorization_servers array also causes an unhandled IndexError.

Root Cause

The except clauses in all three functions are too narrow:

  • Lines 149, 169: except (RequestError, ValidationError) — missing json.JSONDecodeError
  • Line 279: except RequestError — missing json.JSONDecodeError and IndexError

Fix

Add json.JSONDecodeError (and IndexError where applicable) to the exception handlers. json is already imported at the top of the file.

extent analysis

TL;DR

Add json.JSONDecodeError and IndexError to the exception handlers in the affected OAuth discovery functions to handle non-JSON responses and empty lists.

Guidance

  • Identify the three affected functions: discover_protected_resource_metadata(), discover_oauth_authorization_server_metadata(), and check_support_resource_discovery().
  • Update the except clauses in these functions to catch json.JSONDecodeError in addition to the existing exceptions.
  • For check_support_resource_discovery(), also catch IndexError to handle empty authorization_servers lists.
  • Verify that the updated functions can handle non-JSON responses and empty lists without crashing.

Example

try:
    response_json = response.json()
except (RequestError, ValidationError, json.JSONDecodeError):
    # Handle non-JSON response or JSON decode error
    pass

Notes

The fix assumes that the json module is already imported in the affected file. If not, add import json at the top of the file.

Recommendation

Apply the workaround by updating the exception handlers in the affected functions to catch json.JSONDecodeError and IndexError. This will allow the OAuth discovery functions to handle non-JSON responses and empty lists without crashing.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#dependency error#configuration error#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING