fix: reject malformed Content-Type headers with invalid_request

[dhensby]

Summary

A request with a Content-Type header whose media type is empty, such as ;charset=utf-8, makes type-is (2.1.0) throw TypeError: argument string is required. Request#is() lets that error escape, so:

• TokenHandler#handle() rejects with the raw TypeError and not an OAuth error. Its request.is('application/x-www-form-urlencoded') check runs before the try block, so the error is never normalised.
• AuthenticateHandler#handle(), when the access token is sent in the body, wraps the TypeError in a ServerError (503) for what is a client error.

This PR makes Request#is() treat a Content-Type that type-is cannot parse as not matching (false). That is already how it treats a missing or otherwise invalid type. Both handlers now reject the request with InvalidRequestError (400): Invalid request: content must be application/x-www-form-urlencoded, the same as for any other wrong content type.

I fixed it in Request#is(), not by moving the TokenHandler check into its try block. Moving the check would only turn the raw TypeError into a 503, and it would leave AuthenticateHandler unfixed.

Linked issue(s)

None. Found while reviewing other open PRs.

Involved parts of the project

• lib/request.js: Request#is()
• Token endpoint (TokenHandler) and bearer-token-in-body authentication (AuthenticateHandler)

Added tests?

Yes. Each of these fails on master with TypeError: argument string is required and passes here:

• Request integration › is() › should return false if the content type is malformed
• TokenHandler integration › handle() › should throw an error if the media type is malformed
• AuthenticateHandler integration › getTokenFromRequestBody() › should throw an error if the media type is malformed

biome check . is clean and the full mocha suite passes (467).

OAuth2 standard

RFC 6749 §3.2 requires application/x-www-form-urlencoded for token requests, and RFC 6750 §2.2 requires it for bearer tokens in the body. A malformed Content-Type is a malformed request, so it gets invalid_request (RFC 6749 §5.2 / RFC 6750 §3.1), not a server error.

Reproduction

const { Request, Response } = require('@node-oauth/oauth2-server');
const TokenHandler = require('@node-oauth/oauth2-server/lib/handlers/token-handler');

const handler = new TokenHandler({
  accessTokenLifetime: 120,
  refreshTokenLifetime: 120,
  model: { getClient() {}, saveToken() {}, getUser() {} },
});
const request = new Request({
  method: 'POST',
  query: {},
  body: { grant_type: 'password' },
  headers: { 'content-type': ';charset=utf-8', 'transfer-encoding': 'chunked' },
});

await handler.handle(request, new Response());
// master:  TypeError: argument string is required
// this PR: InvalidRequestError: Invalid request: content must be application/x-www-form-urlencoded

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The localized fix preserves successful matching and includes targeted regression coverage, with no unresolved findings.

0 open findings

What changed in this PR

Makes malformed Content-Type headers follow existing OAuth validation paths, producing invalid_request instead of unexpected errors.

Changes:

• Returns false when Content-Type parsing throws in Request#is().
• Adds regression coverage for request matching and both affected handlers.

File	Description
test/​integration/​request_test.js	Tests malformed Content-Type matching.
test/​integration/​handlers/​token-handler_test.js	Tests token endpoint rejection.
test/​integration/​handlers/​authenticate-handler_test.js	Tests body-token validation rejection.
lib/​request.js	Converts parsing exceptions into non-matches.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.