-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Labels
bugSomething isn't workingSomething isn't workingenhancementNew feature or requestNew feature or requestinvalidThis doesn't seem rightThis doesn't seem rightsecuritySecurity features/loopholes to add or fix.Security features/loopholes to add or fix.
Description
When the A2AFastAPI server receives an invalid JSON-RPC request (e.g. missing required fields), the _handle_requests correctly validates the request, generates the proper JSON-RPC error response (e.g. -32602 Invalid parameters), but always returns it with HTTP 200 OK.
ERROR a2a.server.apps.jsonrpc.jsonrpc_app Failed to validate base JSON-RPC request
pydantic_core._pydantic_core.ValidationError: 1 validation error for SendMessageRequest
params.message.messageId
Field required [type=missing, ...]
INFO: $URL:$PORT - "POST / HTTP/1.1" 200 OK
WARNING a2a.server.apps.jsonrpc.jsonrpc_app Request Error (ID: 1): Code=-32602, Message='Invalid parameters'The JSON-RPC error body is correct (-32602), but the HTTP transport layer reports 200 OK
What is expected to happen?
JSON-RPC validation errors should map to semantically appropriate HTTP status codes. A reasonable mapping would be:
| JSON-RPC Error Code | Meaning | Suggested HTTP Status |
|---|---|---|
-32700 |
Parse error (malformed JSON) | 400 Bad Request |
-32600 |
Invalid request (bad JSON-RPC structure) | 400 Bad Request |
-32602 |
Invalid params (missing/bad fields) | 400 Bad Request |
-32601 |
Method not found | 404 Not Found or 400 Bad Request |
-32603 |
Internal error | 500 Internal Server Error |
Successful JSON-RPC responses (including application-level errors like "task not found") should remain 200.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingenhancementNew feature or requestNew feature or requestinvalidThis doesn't seem rightThis doesn't seem rightsecuritySecurity features/loopholes to add or fix.Security features/loopholes to add or fix.