POST /_continuwuity/oauth2/client/register returns 200 with empty body #2023

New issue

Open

opened 2026-07-19 21:11:29 +00:00 by tomsh · 0 comments

tomsh commented

2026-07-19 21:11:29 +00:00

POST /_continuwuity/oauth2/client/register returns HTTP 200 but with a
completely empty response body (0 bytes), instead of a JSON object
containing client_id etc. per RFC 7591 / MSC2966.

This causes Element X to fail with:
"client registration failed: failed to deserialize registration
response: EOF while parsing value at line 1 column 0"

Important: this specifically affects Element X's develop branch, which
uses OIDC-based dynamic client registration (MSC2965) during login.
The current stable Element X release (Play Store / F-Droid) does NOT
attempt this flow and works fine against Continuwuity as-is. This bug
is currently "invisible" to most users, but will likely surface once
Element X's stable release adopts the same OIDC-first login flow that
the develop branch already uses.

Reproduction:
curl -s -o /tmp/resp.json -w "%{http_code}\n" -X POST
https:///_continuwuity/oauth2/client/register
-H "Content-Type: application/json"
-d '{"client_name":"test","redirect_uris":["https://element.io/callback"]}'

Result: HTTP 200, response body is 0 bytes (verified with wc -c).

Tested on Continuwuity v26.6.2 (latest release at time of testing).

Note: I've since migrated to Tuwunel for unrelated reasons, so I can't
easily test further iterations of a fix, but wanted to leave this
documented for others hitting the same issue.

POST /_continuwuity/oauth2/client/register returns HTTP 200 but with a completely empty response body (0 bytes), instead of a JSON object containing client_id etc. per RFC 7591 / MSC2966. This causes Element X to fail with: "client registration failed: failed to deserialize registration response: EOF while parsing value at line 1 column 0" Important: this specifically affects Element X's develop branch, which uses OIDC-based dynamic client registration (MSC2965) during login. The current stable Element X release (Play Store / F-Droid) does NOT attempt this flow and works fine against Continuwuity as-is. This bug is currently "invisible" to most users, but will likely surface once Element X's stable release adopts the same OIDC-first login flow that the develop branch already uses. Reproduction: curl -s -o /tmp/resp.json -w "%{http_code}\n" -X POST \ https://<server>/_continuwuity/oauth2/client/register \ -H "Content-Type: application/json" \ -d '{"client_name":"test","redirect_uris":["https://element.io/callback"]}' Result: HTTP 200, response body is 0 bytes (verified with wc -c). Tested on Continuwuity v26.6.2 (latest release at time of testing). Note: I've since migrated to Tuwunel for unrelated reasons, so I can't easily test further iterations of a fix, but wanted to leave this documented for others hitting the same issue.