Link [ ] is not valid and is not part of the interrupt…

Error message

Link [{}] is not valid and is not part of the interrupt response

What it means

FinalizeInterruptFlowAction validates any 'link' request parameter the user clicked after the interrupt screen against the links recorded in the stored interrupt response. If the link is not one of the response's links, CAS warns 'Link [{}] is not valid and is not part of the interrupt response' and throws UnauthorizedServiceException.denied("Rejected").

Solutions

Retry the interrupt flow from the beginning so a fresh, valid response with current links is generated
Verify link URLs configured for the service interrupt match exactly what the user clicks
Clear stale interrupt tracking state/bookmarks after updating interrupt messages
Treat repeated occurrences as potential malicious probing and review access logs

Example fix

// before (link updated but user hits old bookmark)
GET /cas/login?service=...&link=https://old.example.com
// after (user restarts flow and clicks current link)
GET /cas/login?service=...&link=https://current.example.com

Defensive patterns

Strategy: validation

Validate before calling

val validLink = interruptResponse.getLinks().containsValue(link);
if (!validLink) { /* do not follow the link; restart the interrupt flow */ }

Try / catch

try { finalizeFlow(requestContext); } catch (UnauthorizedServiceException e) { restartInterruptFlow(); }

Prevention

Never bookmark interrupt link URLs
Ensure configured link URLs exactly match rendered links
Regenerate the flow after changing interrupt messages
Log repeated invalid link attempts as suspicious

When it happens

Trigger: Replaying/forging a 'link' request parameter to the interrupt finalize endpoint, or a link URL in the registered service's interrupt configuration that does not match what was rendered/recorded in the response.

Common situations: Bookmarked stale links after interrupt messages changed, service definitions updated so old links are no longer valid, or probing attempts trying to redirect elsewhere.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/0fbb853d792d3aea. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-interrupt-webflow/src/main/java/org/apereo/cas/interrupt/webflow/actions/FinalizeInterruptFlowAction.java:52

                .map(service -> service.getAccessStrategy().getUnauthorizedRedirectUrl())
                .orElse(null);
            if (accessUrl != null) {
                val url = accessUrl.toURL().toExternalForm();
                val externalContext = requestContext.getExternalContext();
                externalContext.requestExternalRedirect(url);
                externalContext.recordResponseComplete();
                return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_STOP);
            }
            LOGGER.warn("Interrupt response has blocked the authentication flow");
            throw UnauthorizedServiceException.denied("Rejected");
        }

        if (requestContext.getRequestParameters().contains("link")) {
            val link = requestContext.getRequestParameters().get("link");
            LOGGER.debug("Finalizing interrupt flow with link [{}]", link);
            val validLink = response.getLinks().containsValue(link);
            if (!validLink) {
                LOGGER.warn("Link [{}] is not valid and is not part of the interrupt response", link);
                throw UnauthorizedServiceException.denied("Rejected");
            }
        }
        
        val authentication = WebUtils.getAuthentication(requestContext);
        interruptTrackingEngine.trackInterrupt(requestContext, response);
        WebUtils.putAuthentication(authentication, requestContext);
        WebUtils.putInterruptAuthenticationFlowFinalized(requestContext);
        return success();
    }
}

View on GitHub (pinned to e7288fc434)