{"action":"created","issue":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/536","labels_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/536/labels{/name}","comments_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/536/comments","events_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/536/events","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/536","id":103303265,"number":536,"title":"Bug in OAuthExceptionHandlerMiddleware: Invalid HTTP headers","user":{"login":"michaelhogg","id":6292810,"avatar_url":"https://avatars.githubusercontent.com/u/6292810?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelhogg","html_url":"https://github.com/michaelhogg","followers_url":"https://api.github.com/users/michaelhogg/followers","following_url":"https://api.github.com/users/michaelhogg/following{/other_user}","gists_url":"https://api.github.com/users/michaelhogg/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelhogg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelhogg/subscriptions","organizations_url":"https://api.github.com/users/michaelhogg/orgs","repos_url":"https://api.github.com/users/michaelhogg/repos","events_url":"https://api.github.com/users/michaelhogg/events{/privacy}","received_events_url":"https://api.github.com/users/michaelhogg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-26T15:48:40Z","updated_at":"2015-10-04T21:20:14Z","closed_at":null,"body":"The bug is in [this line](https://github.com/lucadegasperi/oauth2-server-laravel/blob/5.0.1/src/Middleware/OAuthExceptionHandlerMiddleware.php#L43) in `Middleware\\OAuthExceptionHandlerMiddleware`:\r\n\r\n```php\r\nreturn new JsonResponse($data, $e->httpStatusCode, $e->getHttpHeaders());\r\n```\r\n\r\n`$e` is an instance of [`League\\OAuth2\\Server\\Exception\\OAuthException`](https://github.com/thephpleague/oauth2-server/blob/4.1.3/src/Exception/OAuthException.php),\r\nand [`getHttpHeaders()`](https://github.com/thephpleague/oauth2-server/blob/4.1.3/src/Exception/OAuthException.php#L80) returns an **indexed** array, eg:\r\n\r\n```php\r\n[\r\n    'HTTP/1.1 400 Bad Request',\r\n    'WWW-Authenticate: Bearer realm=\"\"'\r\n]\r\n```\r\n\r\nThat indexed array of headers passes through these constructors:\r\n\r\n  * [`Illuminate\\Http\\JsonResponse::__construct()`](https://github.com/laravel/framework/blob/v5.1.10/src/Illuminate/Http/JsonResponse.php#L27)\r\n  * [`Symfony\\Component\\HttpFoundation\\JsonResponse::__construct()`](https://github.com/symfony/symfony/blob/v2.7.3/src/Symfony/Component/HttpFoundation/JsonResponse.php#L41)\r\n  * [`Symfony\\Component\\HttpFoundation\\Response::__construct()`](https://github.com/symfony/symfony/blob/v2.7.3/src/Symfony/Component/HttpFoundation/Response.php#L199)\r\n  * [`Symfony\\Component\\HttpFoundation\\ResponseHeaderBag::__construct()`](https://github.com/symfony/symfony/blob/v2.7.3/src/Symfony/Component/HttpFoundation/ResponseHeaderBag.php#L51)\r\n  * [`Symfony\\Component\\HttpFoundation\\HeaderBag::__construct()`](https://github.com/symfony/symfony/blob/v2.7.3/src/Symfony/Component/HttpFoundation/HeaderBag.php#L33)\r\n\r\n:warning: The `HeaderBag` constructor expects an **associative** array of headers, such as:\r\n\r\n```php\r\n[\r\n    'Accept'       => '*/*',\r\n    'Content-Type' => 'application/json'\r\n]\r\n```\r\n\r\nSo the `$e->getHttpHeaders()` indexed array is interpreted as:\r\n\r\n```php\r\n[\r\n    '0' => 'HTTP/1.1 400 Bad Request',\r\n    '1' => 'WWW-Authenticate: Bearer realm=\"\"'\r\n]\r\n```\r\n\r\nand so Laravel outputs HTTP headers like this:\r\n\r\n    HTTP/1.0 400 Bad Request\r\n    0: HTTP/1.1 400 Bad Request\r\n    1: WWW-Authenticate: Bearer realm=\"\"\r\n    Cache-Control: no-cache\r\n    Connection: close\r\n    Content-Type: application/json\r\n\r\n:x: These are not valid HTTP headers:\r\n\r\n    0: HTTP/1.1 400 Bad Request\r\n    1: WWW-Authenticate: Bearer realm=\"\"\r\n"},"comment":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/comments/145388557","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/536#issuecomment-145388557","issue_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/536","id":145388557,"user":{"login":"mandado","id":2823627,"avatar_url":"https://avatars.githubusercontent.com/u/2823627?v=3","gravatar_id":"","url":"https://api.github.com/users/mandado","html_url":"https://github.com/mandado","followers_url":"https://api.github.com/users/mandado/followers","following_url":"https://api.github.com/users/mandado/following{/other_user}","gists_url":"https://api.github.com/users/mandado/gists{/gist_id}","starred_url":"https://api.github.com/users/mandado/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mandado/subscriptions","organizations_url":"https://api.github.com/users/mandado/orgs","repos_url":"https://api.github.com/users/mandado/repos","events_url":"https://api.github.com/users/mandado/events{/privacy}","received_events_url":"https://api.github.com/users/mandado/received_events","type":"User","site_admin":false},"created_at":"2015-10-04T21:20:14Z","updated_at":"2015-10-04T21:20:14Z","body":"@michaelhogg  how i can reproduce this bug?"}}