🐛 Bug Report: /.well-known/openid-configuration endpoint has Content-Type as text/html #558

New Issue

OVERLORD · 2026-02-04T20:27:39+03:00

OVERLORD commented

2026-02-04 20:27:39 +03:00

Originally created by @suyash01 on GitHub (Dec 1, 2025).

Reproduction steps

Run curl command and observe the headers

curl -I https://<my-domain>/.well-known/openid-configuration

HTTP/1.1 200 OK
Server: openresty
Date: Mon, 01 Dec 2025 19:31:26 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2025
Connection: keep-alive
Access-Control-Allow-Headers: Authorization
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Origin: *
Cache-Control: no-store
Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'

Expected behavior

The Content-Type header should be text/html.

Actual Behavior

The Content-Type header is text/html.

Pocket ID Version

v1.16.0

Database

SQLite

OS and Environment

Debian GNU/Linux 13, Running on Proxmox LXC, Served via Nginx proxy manager.

Log Output

No response

Originally created by @suyash01 on GitHub (Dec 1, 2025). ### Reproduction steps Run curl command and observe the headers `curl -I https://<my-domain>/.well-known/openid-configuration` ``` HTTP/1.1 200 OK Server: openresty Date: Mon, 01 Dec 2025 19:31:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2025 Connection: keep-alive Access-Control-Allow-Headers: Authorization Access-Control-Allow-Methods: GET, POST Access-Control-Allow-Origin: * Cache-Control: no-store Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' ``` ### Expected behavior The `Content-Type` header should be `text/html`. ### Actual Behavior The `Content-Type` header is `text/html`. ### Pocket ID Version v1.16.0 ### Database SQLite ### OS and Environment Debian GNU/Linux 13, Running on Proxmox LXC, Served via Nginx proxy manager. ### Log Output _No response_

OVERLORD closed this issue

2026-02-04 20:27:44 +03:00

OVERLORD commented

2026-02-04 20:27:49 +03:00

@stonith404 commented on GitHub (Dec 2, 2025):

This happens because you use the -i flag which makes a HEAD instead of GET request to the endpoint. As a HEAD request doesn't run the actual handler logic in the backend the header gets set incorrectly. If you make a normal GET request the content type should be correct.

Do you actually encounter any issues or is this just something you've noticed?

@stonith404 commented on GitHub (Dec 2, 2025): This happens because you use the `-i` flag which makes a `HEAD` instead of `GET` request to the endpoint. As a `HEAD` request doesn't run the actual handler logic in the backend the header gets set incorrectly. If you make a normal `GET` request the content type should be correct. Do you actually encounter any issues or is this just something you've noticed?

OVERLORD commented

2026-02-04 20:27:53 +03:00

@suyash01 commented on GitHub (Dec 2, 2025):

I was trying to integrate pocketid with pulse monitoring, but I am seeing the same error in pulse logs. Maybe they have not implemented it correctly?

I will try to dig deeper when I go home later today.

@suyash01 commented on GitHub (Dec 2, 2025): I was trying to integrate pocketid with pulse monitoring, but I am seeing the same error in pulse logs. Maybe they have not implemented it correctly? I will try to dig deeper when I go home later today.

OVERLORD commented

2026-02-04 20:27:57 +03:00

@suyash01 commented on GitHub (Dec 2, 2025):

Closing as after doing some digging I figured out that they just needed the base URL instead of the complete discovery URL.

@suyash01 commented on GitHub (Dec 2, 2025): Closing as after doing some digging I figured out that they just needed the base URL instead of the complete discovery URL.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#558