{"record":{"id":"216616d8c6d3749f","repo":"apereo/cas","slug":"cas-is-configured-to-only-accept-pushed-authorizat","errorCode":null,"errorMessage":"CAS is configured to only accept pushed authorization requests and this is not a POST","messagePattern":"CAS is configured to only accept pushed authorization requests and this is not a POST","errorType":"console","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcHandlerInterceptorAdapter.java","lineNumber":69,"sourceCode":"            oauthRequestParameterResolver);\n\n        this.requiresAuthenticationDynamicRegistrationInterceptor = requiresAuthenticationDynamicRegistrationInterceptor;\n        this.casProperties = casProperties;\n        this.requiresAuthenticationClientConfigurationInterceptor = requiresAuthenticationClientConfigurationInterceptor;\n    }\n\n    @Override\n    public boolean preHandle(final HttpServletRequest request, final HttpServletResponse response,\n                             final Object handler) throws Exception {\n\n        LOGGER.trace(\"Attempting to pre-handle OIDC request at [{}] with parameters [{}]\",\n            request.getRequestURI(), request.getParameterMap().keySet());\n\n        if (casProperties.getAuthn().getOidc().getDiscovery().isRequirePushedAuthorizationRequests()\n            && !HttpMethod.valueOf(request.getMethod()).equals(HttpMethod.POST)\n            && StringUtils.isBlank(request.getParameter(OidcConstants.REQUEST_URI))\n            && isAuthorizationRequest(request, response)) {\n            LOGGER.warn(\"CAS is configured to only accept pushed authorization requests and this is not a POST\");\n            response.setStatus(HttpStatus.SC_FORBIDDEN);\n            return false;\n        }\n\n        if (!isDynamicClientRegistrationEnabled() && (isClientConfigurationRequest(request.getRequestURI()) || isDynamicClientRegistrationRequest(request.getRequestURI()))) {\n            LOGGER.debug(\"Dynamic client registration is disabled. OIDC request at [{}] is rejected.\", request.getRequestURI());\n            response.setStatus(HttpStatus.SC_NOT_IMPLEMENTED);\n            return false;\n        }\n\n        if (isPushedAuthorizationRequest(request.getRequestURI()) && !isValidAuthorizeRequest(new JEEContext(request, response))) {\n            LOGGER.warn(\"Invalid OIDC pushed authorization request at [{}]\", request.getRequestURI());\n            response.setStatus(HttpStatus.SC_FORBIDDEN);\n            writeErrorResponseBody(response);\n            return false;\n        }\n\n        if (isVerifiableCredentialTransactionRequest(request.getRequestURI()) || isPushedAuthorizationRequest(request.getRequestURI())) {","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcHandlerInterceptorAdapter.java#L51-L87","documentation":"CAS's OIDC request interceptor rejects non-POST authorization requests when 'requirePushedAuthorizationRequests' is enabled, unless the request uses a request_uri (i.e. an already-pushed request). Per JAR/PAR, when this mode is on, clients must first POST parameters to the pushed authorization request endpoint and then hit /authorize with only request_uri. This is a deliberate rejection (HTTP 403) enforced in OidcHandlerInterceptorAdapter.preHandle.","triggerScenarios":"A GET to the OIDC /authorize endpoint (or any non-POST authorize request) while cas.authn.oidc.discovery.require-pushed-authorization-requests=true, the request has no 'request_uri' parameter, and it looks like an authorization request.","commonSituations":"Deployers flip on requirePushedAuthorizationRequests but existing client applications still perform plain GET-based browser redirects to /authorize; legacy clients or tutorials that never adopted PAR; misconfigured RP libraries that ignore the 'require_pushed_authorization_requests' discovery flag.","solutions":["Update all relying parties to POST authorization parameters to the PAR endpoint (/oidc/pushAuthRequest or similar) and then redirect to /authorize with the returned request_uri","Set cas.authn.oidc.discovery.require-pushed-authorization-requests=false if you do not actually need PAR","Verify the request carries a non-blank request_uri parameter if it is a follow-up authorize call","Upgrade the RP's OIDC client library to one supporting RFC 9126 PAR"],"exampleFix":"// before\nGET /oidc/authorize?response_type=code&client_id=client&scope=openid&redirect_uri=...\n// after\nPOST /oidc/pushAuthRequest (response_type=code&client_id=client&...) -> {\"request_uri\":\"urn:ietf:params:oauth:request_uri:...\"}\nGET /oidc/authorize?client_id=client&request_uri=urn:ietf:params:oauth:request_uri:...","handlingStrategy":"validation","validationCode":"const isParMode = casProperties.authn.oidc.discovery.requirePushedAuthorizationRequests;\nconst isAuthorizeWithUri = url.searchParams.get('request_uri')?.trim() !== '';\nif (isParMode && method !== 'POST' && !isAuthorizeWithUri) throw new Error('PAR required: POST parameters to the PAR endpoint first');","typeGuard":"function hasRequestUri(params) {\n  return typeof params.request_uri === 'string' && params.request_uri.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Read discovery metadata and honor require_pushed_authorization_requests","Implement the PAR POST step in the RP before redirecting to /authorize","Test the full PAR -> authorize flow after enabling the mode","Keep request_uri intact through redirects (it is short-lived)"],"tags":["oidc","par","http-403","authorization-request"],"backgroundTag":"oauth-request-rejected","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}