Add RFC-compliant error handling for TokenIntrospectionController #5348
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…hub.com/microsoft/fhir-server into personal/mikaelw/fix-415-error-handling
mikaelweave
added
Azure Healthcare APIs
- Added OAuth2BadRequestException for handling bad request errors. - Introduced OAuth2ExceptionFilterAttribute to return RFC 6749 compliant error responses. - Updated TokenIntrospectionController to validate content type and token presence. - Enhanced TokenIntrospectionControllerTests to cover new validation scenarios. - Added documentation for token introspection examples.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/Microsoft.Health.Fhir.Shared.Api/Controllers/TokenIntrospectionController.cs
Fixed
Show fixed
Hide fixed
…w any data action for token introspection
…tityProviderRegistrationExtensions and FhirServerServiceCollectionExtensions
…s and remove redundant authorization call from FhirServerServiceCollectionExtensions
mikaelweave
changed the title
mikaelweave
added
Azure API for FHIR
rbans96
reviewed
Jan 28, 2026
src/Microsoft.Health.Fhir.Shared.Api/Controllers/TokenIntrospectionController.cs
Outdated
Show resolved
Hide resolved
rbans96
reviewed
Jan 28, 2026
src/Microsoft.Health.Fhir.Shared.Api/Controllers/TokenIntrospectionController.cs
Outdated
Show resolved
Hide resolved
Contributor
Author
|
@copilot can you address the PR comments from rbans96 and add any strings in the resource files as needed? |
1 task
Contributor
|
@mikaelweave I've opened a new pull request, #5357, to work on those changes. Once the pull request is ready, I'll request review from you. |
* Initial plan * Move error messages to Resources.resx for localization Co-authored-by: mikaelweave <753437+mikaelweave@users.noreply.github.com> * Add periods to error messages for consistency Co-authored-by: mikaelweave <753437+mikaelweave@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: mikaelweave <753437+mikaelweave@users.noreply.github.com>
rbans96
approved these changes
Jan 28, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Adds RFC 6749/7662 compliant error handling for the Token Introspection endpoint by decoupling it from FHIR-specific exception handling.
AB#181870
Changes:
OAuth2BadRequestException: Exception type for OAuth2 errors witherroranderror_descriptionproperties per RFC 6749OAuth2ExceptionFilterAttribute: Returns JSON error responses (not FHIR OperationOutcome) for OAuth2 endpointsapplication/x-www-form-urlencodedper RFC 7662 Section 2.1OperationOutcomeExceptionFilterAttributetoOAuth2ExceptionFilterAttributeWhy this change?
OAuth2 endpoints must return RFC 6749 error format (
{"error": "...", "error_description": "..."}), not FHIR OperationOutcome responses. The TokenIntrospectionController was incorrectly using FHIR error handling.Alternatives Considered
Related issues
Ensures token introspection endpoint returns spec-compliant error responses.
Testing
OAuth2ExceptionFilterAttributeTokenIntrospectionControllerTestsfor exception-based validation