fix: add omitempty to optional URI fields in Client JSON serialization #4050
+54
−415
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
panbanda
changed the title
Optional fields (policy_uri, tos_uri, client_uri, logo_uri, contacts) were serialized as empty strings or null when not set. This breaks strict JSON validators like Zod that expect these fields to either be present with valid values or omitted entirely. RFC 7591 specifies these fields as optional, so omitting them when empty is the correct behavior for DCR responses.
panbanda
force-pushed
the
fix/dcr-omitempty-optional-fields
branch
3 times, most recently
from
1a68a71 to
473f544
Compare
Remove contacts field from snapshot to match omitempty serialization and fix goimports ordering in oryx package files to pass CI format check.
panbanda
force-pushed
the
fix/dcr-omitempty-optional-fields
branch
from
473f544 to
a848a71
Compare
Add omitempty JSON tag to client_name, owner, subject_type, and scope fields to ensure they are omitted from JSON output when empty, per RFC 7591 requirements for optional DCR fields. Fixes ory#4044
panbanda
force-pushed
the
fix/dcr-omitempty-optional-fields
branch
from
c4f3ade to
58f2e14
Compare
The snapshot files need to have multi-line empty object format
("extra": {\n}) to match the actual test output.
Author
|
Hey @aeneasr is there anything I can do to help merge this in to unblock integrations with agents? Happy to update or change anything per direction. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
omitemptyJSON tag to optional URI fields (policy_uri,tos_uri,client_uri,logo_uri) andcontactsin the Client struct""ornullProblem
When using Dynamic Client Registration (RFC 7591), Hydra returns empty strings for optional URI fields and
nullfor the contacts array when they are not set:{ "client_id": "...", "logo_uri": "", "tos_uri": "", "policy_uri": "", "client_uri": "", "contacts": null }This breaks strict JSON validators (e.g., Zod) that expect optional fields to either have valid values or be omitted entirely. RFC 7591 specifies these fields as optional, so omitting them when empty is the correct behavior.
Real-world impact
This issue affects mcp-remote, a tool for connecting to remote MCP (Model Context Protocol) servers. When mcp-remote uses DCR to dynamically register OAuth clients with Hydra, the response fails Zod validation because of the unexpected empty strings and null values for optional fields.
Changes
client/client.go: Addedomitemptyto 5 optional fieldsclient/client_test.go: Added testTestClientJSONOmitsEmptyOptionalURIFieldsto verify behaviorTesting
go test -v -race ./client/ -run TestClientJSONOmitsEmptyOptionalURIFieldsFixes #4044