{"record":{"id":"114e8ae72d634c94","repo":"spring-projects/spring-security","slug":"server-error-114e8a","errorCode":"server_error","errorMessage":"Unable to process the OpenID Connect 1.0 RP-Initiated Logout response.","messagePattern":"Unable to process the OpenID Connect 1\\.0 RP-Initiated Logout response\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":500,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/authentication/OidcLogoutAuthenticationSuccessHandler.java","lineNumber":78,"sourceCode":"\tprivate final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();\n\n\tprivate final SecurityContextLogoutHandler securityContextLogoutHandler = new SecurityContextLogoutHandler();\n\n\tprivate LogoutHandler logoutHandler = this::performLogout;\n\n\t@Override\n\tpublic void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,\n\t\t\tAuthentication authentication) throws IOException, ServletException {\n\n\t\tif (!(authentication instanceof OidcLogoutAuthenticationToken)) {\n\t\t\tif (this.logger.isErrorEnabled()) {\n\t\t\t\tthis.logger.error(Authentication.class.getSimpleName() + \" must be of type \"\n\t\t\t\t\t\t+ OidcLogoutAuthenticationToken.class.getName() + \" but was \"\n\t\t\t\t\t\t+ authentication.getClass().getName());\n\t\t\t}\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"Unable to process the OpenID Connect 1.0 RP-Initiated Logout response.\", null);\n\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t}\n\n\t\tthis.logoutHandler.logout(request, response, authentication);\n\n\t\tsendLogoutRedirect(request, response, authentication);\n\t}\n\n\t/**\n\t * Sets the {@link LogoutHandler} used for performing logout.\n\t * @param logoutHandler the {@link LogoutHandler} used for performing logout\n\t */\n\tpublic void setLogoutHandler(LogoutHandler logoutHandler) {\n\t\tAssert.notNull(logoutHandler, \"logoutHandler cannot be null\");\n\t\tthis.logoutHandler = logoutHandler;\n\t}\n\n\tprivate void performLogout(HttpServletRequest request, HttpServletResponse response,\n\t\t\t@Nullable Authentication authentication) {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/authentication/OidcLogoutAuthenticationSuccessHandler.java#L60-L96","documentation":"This OAuth2AuthenticationException with server_error is thrown by OidcLogoutAuthenticationSuccessHandler.onAuthenticationSuccess when the Authentication is not an OidcLogoutAuthenticationToken. The handler can only process RP-Initiated Logout results, so an unexpected authentication type indicates an internal misconfiguration. It logs the actual type before throwing.","triggerScenarios":"Registering OidcLogoutAuthenticationSuccessHandler on a filter/handler chain that delivers a different Authentication type (e.g. a plain logout token or another token type) to onAuthenticationSuccess.","commonSituations":"Custom security filter chains wiring the success handler to the wrong authentication provider; misordered filters so another authentication type reaches the handler; copying example code into an unrelated endpoint's success handler.","solutions":["Ensure the success handler is only wired to the OidcLogoutAuthentication processing path (OidcLogoutEndpointFilter)","Check the authentication provider that produces the result actually emits OidcLogoutAuthenticationToken","Review the log line naming the unexpected Authentication type to find the miswired filter","If handling generic logout, use a different/independent success handler"],"exampleFix":"// before: attached to generic logout\n.exceptionHandling(e -> e.authenticationEntryPoint(new OidcLogoutAuthenticationSuccessHandler(...)))\n// after: attach where OidcLogoutAuthenticationToken is produced\n.addFilterBefore(oidcLogoutEndpointFilter, ...); // filter uses the handler on success","handlingStrategy":"type-guard","validationCode":"// Only wire the handler where OidcLogoutAuthenticationToken is produced\nif (!(authentication instanceof OidcLogoutAuthenticationToken)) {\n    throw new IllegalStateException(\"Handler wired to wrong filter\");\n}","typeGuard":"boolean isOidcLogout(Authentication a) {\n    return a instanceof OidcLogoutAuthenticationToken;\n}","tryCatchPattern":"try {\n    handler.onAuthenticationSuccess(request, response, authentication);\n} catch (OAuth2AuthenticationException e) {\n    if (\"server_error\".equals(e.getError().getErrorCode())) {\n        logger.error(\"RP-Initiated Logout handler misconfigured: {}\", e.getError());\n    }\n}","preventionTips":["Attach OidcLogoutAuthenticationSuccessHandler only to the OIDC logout endpoint path","Verify your security filter chain order for OIDC logout processing","Unit-test the success handler with an OidcLogoutAuthenticationToken instance"],"tags":["openid-connect","logout","spring-security","misconfiguration"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}