[bug] Nonexistent paths under `/.well-known/` yield 200 OK response #447

New issue

Open

opened 2025-09-20 21:14:58 +00:00 by thcrt · 0 comments

thcrt commented

2025-09-20 21:14:58 +00:00

In commit cb48c95 to the Mastodon.py library, a method is added that queries the endpoint /.well-known/oauth-authorization-server. This endpoint should provide authorization server metadata, as described in RFC 8414.

Supporting this endpoint is a feature request I'll submit separately, but the primary issue I have is that right now, instead of responding with a 404 code, akkoma-fe responds with 200 OK and renders the web UI. This causes Mastodon.py to return an error, as it attempts to parse akkoma-fe HTML as JSON.

Ideally, requests to routes or endpoints that don't exist should get 404 responses, but this is particularly important for paths under /.well-known, as they are likely to be requested programmatically.

Sorry if this is better suited for the main akkoma repository. I'm submitting it here because of its relation to #264.

See also halcy/Mastodon.py#422.

Cheers :)

_{Version: cfbf3ecb6d

Severity: I cannot use it as easily as I'd like.
I have double-checked and have not found this issue mentioned anywhere.}

In commit [`cb48c95`](https://github.com/halcy/Mastodon.py/commit/cb48c95930dc1090b8fa05fc16e84a3abf56501a) to the [Mastodon.py](https://github.com/halcy/Mastodon.py) library, a method is added that queries the endpoint `/.well-known/oauth-authorization-server`. This endpoint should provide authorization server metadata, as described in [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414). Supporting this endpoint is a feature request I'll submit separately, but the primary issue I have is that right now, instead of responding with a 404 code, akkoma-fe responds with 200 OK and renders the web UI. This causes Mastodon.py to return an error, as it attempts to parse akkoma-fe HTML as JSON. Ideally, requests to routes or endpoints that don't exist should get 404 responses, but this is particularly important for paths under `/.well-known`, as they are likely to be requested programmatically. Sorry if this is better suited for the main akkoma repository. I'm submitting it here because of its relation to #264. See also [halcy/Mastodon.py#422](https://github.com/halcy/Mastodon.py/issues/422). Cheers :) --- <sub> **Version:** `cfbf3ecb6d` **Severity:** I cannot use it as easily as I'd like. I have double-checked and have not found this issue mentioned anywhere. </sub>