REST routes crashing, claiming unsupported format

Created on 22 September 2025, 9 days ago

Problem/Motivation

Since the addition of the opt-out feature in https://www.drupal.org/project/simple_oauth/issues/3516409 Introduce an opt-out mechanism that allows specific routes to be excluded from the Authorization header processing Active
REST routes supporting json or xml no longer work.

You get "HTTP/2 406 Not Acceptable" and "No route found for the specified format html. Supported formats: json, xml.", for example.

Here's what I could gather:

The check in \Drupal\simple_oauth\Authentication\Provider\SimpleOauthAuthenticationProvider::applies calls $this->pathValidator->getUrlIfValidWithoutAccessCheck(), which creates a request down the line without any information about the originally requested format, because only the path_info string can be passed. Thus the format defaults to 'html'. But html is not in the list of allowed formats for the route. Thus, \Drupal\Core\Routing\RequestFormatRouteFilter::filter deems the request invalid (-> NotAcceptableHttpException)

Steps to reproduce

- Install simple_oauth version 6.0.1 (6.0.0. still works).
- Have a REST endpoint with json as supported format.
- Get an oauth2 token and call the endpoint.

Proposed resolution

Maybe get the route some other way?

🐛 Bug report
Status

Active

Version

6.0

Component

Code

Created by

🇩🇪Germany cspitzlay 🇩🇪🇪🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024