Our Personal Data Server from scratch! tranquil.farm

Failed to fetch client metadata: error sending request for url #145

Closed joinsakurajima.org
Closed opened by joinsakurajima.org

I have upgraded Tranquil to 0.6.7 and now having issues with the Failed to fetch client metadata: error sending request for url

Here is the error it shows on the Javascript Console if you try to navigate to register or the login page: Failed to ensure OAuth request URI: Error: Failed to fetch client metadata: error sending request for url (https://sakurasora.social/oauth-client-metadata.json)     av https://sakurasora.social/assets/index-Bnh5R7Ul.js:2 index-Bnh5R7Ul.js:12:10510     cP https://sakurasora.social/assets/index-Bnh5R7Ul.js:12

Request information: Image Image Image

Journalctl Output:

26T01:27:36.234498Z INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None

26T01:27:36.234975Z WARN tranquil_oauth::client: Failed to fetch client metadata client_id=https://sakurasora.social/oauth-client-metadata.json error=error sending request for url (https://sakurasora.social/oauth-client>

Sep 26 01:30:21 mizuka.chikorita157.com tranquil-server[3271319]: 2026-09-26T01:30:21.564792Z INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None

Sep 26 01:30:21 mizuka.chikorita157.com tranquil-server[3271319]: 2026-09-26T01:30:21.565229Z WARN tranquil_oauth::client: Failed to fetch client metadata client_id=https://sakurasora.social/oauth-client-metadata.json error=error sending request for url (https://sakurasora.social/oauth-client-metadata.json)

Notes: This is a manual compile install as this is installed running on Red Hat Enterprise Linux with Systemd. I have modified the Apache config to match the nginx one, basically down to three location for /, /xrpc/, and /oauth/. It does mostly work, but you can't login and register new accounts, which is an issue. I am thinking the tranquil-server process cannot read the oauth-client-metadata.json despite existing and Apache properly proxing the frontend and backend from the tranquil-server process.

Hiya! Sorry you're having an issue. Tranquil is not providing a lot of error info here so could I ask you to check some things? Might help us figure it out.

0.6.7 refuses to look up client metadata on private IPs, which is in line with the spec, but it's possible it could be related to this because it would fail silently this way. Plus the failure is very fast, so it probably never went out on the wire. If you run getent ahosts sakurasora.social on that server what do you get? If it's a private IP or loopback then that'll be the issue and we need to find a way to get your server to resolve the public IP instead!

This is what I got. It seems to be going to the localhost IP.

[chikorita157@mizuka ~]$ getent ahosts sakurasora.social 127.0.0.1 STREAM sakurasora.social 127.0.0.1 DGRAM
127.0.0.1 RAW

Well, I checked my hosts file and I found my answer.

Removing the hosts file entry for sakurasora.social fixed the issue. It"s odd that it worked before moving to the new version. With that, I will close this issue.

It's not that the IP won't lead to the right place, it's that resolving private IPs/loopback is a security issue, and the spec disallows it. Tranquil just used to be lax and now it's stricter!

This comment was deleted.

Technically yes, you can see how here https://tangled.org/tranquil.farm/tranquil-pds/blob/main/config.dev.toml#L4. However this config exists to support local dev and is not intended for production use, so I have to emphasize that the spec does not support a CIMD on a private IP (there's a carveout for localhost for dev only) and I wouldn't rely on it as an intended feature, and it is a security risk to set this option because it opens the door for SSRF etc

Sign up or Sign in to add to the discussion.