apereo/cas · warning

Ignoring malformed request

Error message

Ignoring malformed request [{}] as no OAuth20 validator could declare support for its syntax

What it means

The revocation endpoint iterates its configured OAuth20RequestValidators and requires exactly one to declare support for the request's syntax (per RFC 7009 the request must carry a token parameter with client authentication). If no validator supports the request context, the request is malformed and is rejected (verifyRevocationRequest returns false), so revocation is not attempted.

Solutions

1. Send a POST with form-encoded `token` parameter plus valid client authentication (client_id/client_secret or Basic auth).
2. Verify the request body is application/x-www-form-urlencoded and not stripped by a proxy or gateway.
3. Check registered OAuth20RequestValidator beans — if a custom validator was added/removed, ensure at least the standard validator remains and supports the request.
4. Log the full request URL (as the warning does) and compare it against the validator's supports() conditions.

Example fix

// before
curl https://cas/cas/oauth2.0/revoke?token=AT-123  # GET, query param, no auth
// after
curl -X POST -u client:secret -d 'token=AT-123' -H 'Content-Type: application/x-www-form-urlencoded' https://cas/cas/oauth2.0/revoke

// ensure required revocation params before sending
const params = new URLSearchParams({ token, client_id, client_secret });
if (!token || !client_id) throw new Error('revocation requires token and client credentials');
await fetch(revokeUrl, { method: 'POST', headers: {'Content-Type':'application/x-www-form-urlencoded'}, body: params });

When it happens

Trigger: A POST to /oauth2.0/revoke that is missing the required `token` parameter, or otherwise doesn't match any registered validator's supports(context) check (e.g. wrong HTTP method, missing client authentication parameters).

Common situations: Client library sends GET instead of POST, or sends the token under a nonstandard parameter name; reverse proxy strips the body/form params; misconfigured custom validator bean that never declares support; calling the endpoint without client_id/client_secret.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Code verification method is unrecognized:
• No client credentials could be identified in this request
• access_denied
• invalid_request
• Resource ID already exists in namespace .

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ba7311876110fe7a. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/endpoints/OAuth20RevocationEndpointController.java:135

            }
            val mv = new ModelAndView(new JacksonJsonView());
            mv.setStatus(HttpStatus.OK);
            return mv;
        }
        LOGGER.error("Provided token [{}] is either not a refresh token or an access token", token);
        return OAuth20Utils.writeError(response, OAuth20Constants.INVALID_REQUEST);

    }

    private boolean verifyRevocationRequest(final WebContext context) throws Throwable {
        val validator = getConfigurationContext().getAccessTokenGrantRequestValidators().getObject()
            .stream()
            .filter(BeanSupplier::isNotProxy)
            .filter(Unchecked.predicate(requestValidator -> requestValidator.supports(context)))
            .findFirst()
            .orElse(null);
        if (validator == null) {
            LOGGER.warn("Ignoring malformed request [{}] as no OAuth20 validator could declare support for its syntax", context.getFullRequestURL());
            return false;
        }
        return validator.validate(context);
    }
}

View on GitHub (pinned to e7288fc434)