-
Notifications
You must be signed in to change notification settings - Fork 0
Pitfall openid configuration 404
Affects: ChatGPT OAuth discovery
Observed: 2026-07-05
Status: Expected — no fix needed
After a successful ChatGPT OAuth connection, the access log contains:
GET /.well-known/openid-configuration → 404
This appears after the /token call succeeds — meaning ChatGPT already has a working access token when it makes this probe.
ChatGPT probes for OpenID Connect Discovery (OIDC Core §4) at /.well-known/openid-configuration in addition to the standard OAuth 2.0 metadata endpoint (/.well-known/oauth-authorization-server). When it gets 404, it falls back to the OAuth 2.0 metadata and continues normally.
No. The OIDC spec requires this document to include:
-
userinfo_endpoint— endpoint returning claims about the authenticated user -
id_token_signing_alg_values_supported— signing algorithms for ID tokens
This server is a pure OAuth 2.0 authorization server (RFC 6749 + RFC 8414). It does not issue ID tokens and has no userinfo endpoint. Serving a openid-configuration document without these mandatory fields would be spec-incorrect and could confuse clients into attempting OIDC flows that then fail.
The correct posture: serve /.well-known/oauth-authorization-server (which we do) and return 404 for openid-configuration.
If this server ever gains OIDC support (ID tokens, userinfo endpoint, claims), add /.well-known/openid-configuration at that time with the correct mandatory fields.
Related issue: #123