{"record":{"id":"202a45dc7af69dd8","repo":"apereo/cas","slug":"missing-parameter-wresult","errorCode":null,"errorMessage":"Missing parameter wresult","messagePattern":"Missing parameter wresult","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java","lineNumber":58,"sourceCode":"\n    private final WsFederationCookieManager wsFederationCookieManager;\n\n    /**\n     * Validate ws federation authentication request event.\n     *\n     * @param context the context\n     * @throws Throwable the throwable\n     */\n    public void validateWsFederationAuthenticationRequest(final RequestContext context) throws Throwable {\n        val service = wsFederationCookieManager.retrieve(context);\n        LOGGER.debug(\"Retrieved service [{}] from the session cookie\", service);\n\n        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);\n        val wResult = request.getParameter(WRESULT);\n        LOGGER.debug(\"Parameter [{}] received: [{}]\", WRESULT, wResult);\n        if (StringUtils.isBlank(wResult)) {\n            LOGGER.error(\"No [{}] parameter is found\", WRESULT);\n            throw new IllegalArgumentException(\"Missing parameter \" + WRESULT);\n        }\n        LOGGER.debug(\"Attempting to create an assertion from the token parameter\");\n        val rsToken = wsFederationHelper.getRequestSecurityTokenFromResult(wResult);\n        val assertion = wsFederationHelper.buildAndVerifyAssertion(rsToken, configurations, service);\n        if (assertion == null) {\n            LOGGER.error(\"Could not validate assertion via parsing the token from [{}]\", WRESULT);\n            throw new IllegalArgumentException(\"Could not validate assertion via the provided token\");\n        }\n        LOGGER.debug(\"Attempting to validate the signature on the assertion\");\n        if (!wsFederationHelper.validateSignature(assertion)) {\n            val msg = \"WS Requested Security Token is blank or the signature is not valid.\";\n            LOGGER.error(msg);\n            throw new IllegalArgumentException(msg);\n        }\n        buildCredentialsFromAssertion(context, assertion, service);\n    }\n\n    private void buildCredentialsFromAssertion(final RequestContext context,","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java#L40-L76","documentation":"WsFederationResponseValidator.validateWsFederationAuthenticationRequest processes the WS-Fed sign-in response, which must contain the `wresult` parameter carrying the security token returned by the identity provider. If wresult is blank, it throws IllegalArgumentException because no token exists to parse or validate.","triggerScenarios":"The webflow reaches the response-validation action and request.getParameter(WRESULT) returns null/empty — the IdP response POST lacked wresult, or the value was lost in transit (proxy, encoding, session handling).","commonSituations":"Misconfigured WS-Fed client sending wresult only on a different endpoint or dropping it on redirect; intermediaries stripping POST bodies; users bookmarking/reloading the callback URL so the POST body is gone; RP session resumption replaying a GET that never carried wresult.","solutions":["Check that the upstream identity provider actually POSTs `wresult` to the configured CAS callback/claim endpoint.","Inspect the inbound HTTP request (access log or a debug filter) at the moment of failure to confirm whether wresult is absent at the network level or lost inside the webflow.","Ensure any reverse proxy forwards the full form body (Content-Type application/x-www-form-urlencoded) and does not rewrite the callback to a GET.","Guard the flow against page reloads on the validation endpoint (POST-redirect pattern or anti-replay handling) so stale reloads don't resurface this error."],"exampleFix":"// before: relying on a redirect that drops the POST body\nhttp.authorizeHttpRequests(a -> a.requestMatchers(\"/wsfed/callback\").permitAll()); // proxy converts POST to GET\n// after: preserve the POST form data end-to-end and verify wresult presence client-side\nString wresult = request.getParameter(\"wresult\");\nif (wresult == null || wresult.isBlank()) {\n    throw new IllegalStateException(\"Identity provider did not POST wresult to the callback\");\n}","handlingStrategy":"validation","validationCode":"String wresult = request.getParameter(\"wresult\");\nif (wresult == null || wresult.isBlank()) {\n    throw new IllegalStateException(\"Callback must be reached via IdP POST carrying wresult\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure the callback endpoint is only reached via IdP POST, not by bookmarking or GET redirects.","Verify proxies/CDNs forward the full application/x-www-form-urlencoded body.","Log all received parameters at the callback on error to diagnose dropped values quickly."],"tags":["ws-federation","saml-token","http"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}