FusionAuth/go-client

No 2XX status codes without a body may hide errors

davidlopezre opened this issue · 0 comments

The FusionAuth Go client, can hide errors if a response body is not received.

This issue can be replicated by providing a bad URL to the client constructor so that it always returns a 502 with no response body.

For example:

client := fusionauth.NewClient(nil, badUrlThatAlwaysReturnsEmpty502, apiKey)

// then, errors will be empty and err will be nil even though status code is 502
resp, errors, err := client.SearchEntitiesWithContext(ctx, req)

I think this is happening because on non 2XX response, the client intends to unmarshal the body into Errors while setting error to nil. This means, if there's nothing to unmarshal, both error and Errors end up being empty:

https://github.com/FusionAuth/go-client/blob/2d8a30ba49969c598f87ac82ab4d0745e4133deb/pkg/fusionauth/Client.go#L116C3-L116C13