Non-JSON facilitator response leaked in 402
Quirk · GET /api/x402/facilitator-non-json-leaks · Facilitator Dependency
The facilitator returns an HTML maintenance page instead of JSON; the merchant forwards the raw HTML in the 402 response body, leaking internal infrastructure details.
Explanation
The facilitator returned an HTML maintenance page instead of JSON. Rather than catching the parse failure and returning a clean error, the merchant forwarded the raw HTML in the 402 response body. The HTML contains internal build metadata and server identifiers that should never leave the private network. The merchant must sanitize facilitator error responses before propagating them.
What to watch
The 402 body contains a raw HTML error page with internal build tags and server identifiers.
Facilitator
The facilitator is mocked for this scenario — its response is simulated, so no live Radius testnet settlement occurs.
Metadata
- Status: Quirk
- Method: GET
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant