{"record":{"id":"24e3e2edf4147402","repo":"spring-projects/spring-security","slug":"invalid-request-24e3e2","errorCode":"invalid_request","errorMessage":"invalid_request","messagePattern":"invalid_request","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2LoginAuthenticationFilter.java","lineNumber":172,"sourceCode":"\t * the authentication requests\n\t * @since 5.1\n\t */\n\tpublic OAuth2LoginAuthenticationFilter(ClientRegistrationRepository clientRegistrationRepository,\n\t\t\tOAuth2AuthorizedClientRepository authorizedClientRepository, String filterProcessesUrl) {\n\t\tsuper(filterProcessesUrl);\n\t\tAssert.notNull(clientRegistrationRepository, \"clientRegistrationRepository cannot be null\");\n\t\tAssert.notNull(authorizedClientRepository, \"authorizedClientRepository cannot be null\");\n\t\tthis.clientRegistrationRepository = clientRegistrationRepository;\n\t\tthis.authorizedClientRepository = authorizedClientRepository;\n\t}\n\n\t@Override\n\tpublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException {\n\t\tMultiValueMap<String, String> params = OAuth2AuthorizationResponseUtils.toMultiMap(request.getParameterMap());\n\t\tif (!OAuth2AuthorizationResponseUtils.isAuthorizationResponse(params)) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\tOAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestRepository\n\t\t\t.removeAuthorizationRequest(request, response);\n\t\tif (authorizationRequest == null) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(AUTHORIZATION_REQUEST_NOT_FOUND_ERROR_CODE);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\tString registrationId = authorizationRequest.getAttribute(OAuth2ParameterNames.REGISTRATION_ID);\n\t\tAssert.hasText(registrationId, \"registrationId cannot be empty\");\n\t\tClientRegistration clientRegistration = this.clientRegistrationRepository.findByRegistrationId(registrationId);\n\t\tif (clientRegistration == null) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(CLIENT_REGISTRATION_NOT_FOUND_ERROR_CODE,\n\t\t\t\t\t\"Client Registration not found with Id: \" + registrationId, null);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\t\t// @formatter:off\n\t\tString redirectUri = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))\n\t\t\t\t.replaceQuery(null)","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2LoginAuthenticationFilter.java#L154-L190","documentation":"OAuth2LoginAuthenticationFilter.attemptAuthentication throws OAuth2AuthenticationException with code invalid_request when the callback request does not contain a recognizable OAuth2 authorization response: neither code+state nor error parameters are present in the request's parameter map.","triggerScenarios":"A request reaches /login/oauth2/code/{registrationId} without query parameters code & state (or error/error_description) — e.g. a user bookmarking or manually hitting the redirect URI, or the IdP redirecting without parameters.","commonSituations":"Users bookmarking the redirect URI; load balancers or proxies stripping query strings; misconfigured redirect-uri template so the filter's matcher catches unrelated requests.","solutions":["Ensure the authorization request was initiated via /oauth2/authorization/{registrationId} so the IdP redirects back with code and state","Check the IdP's registered redirect URI matches exactly and that no proxy strips query parameters","Point the user back to the login entry point instead of exposing the redirect URI as a navigable page"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"MultiValueMap<String,String> params = OAuth2AuthorizationResponseUtils.toMultiMap(request.getParameterMap());\nif (!OAuth2AuthorizationResponseUtils.isAuthorizationResponse(params)) {\n    response.sendRedirect(\"/oauth2/authorization/myclient\");\n    return;\n}","typeGuard":null,"tryCatchPattern":"catch (OAuth2AuthenticationException e) {\n    if (OAuth2ErrorCodes.INVALID_REQUEST.equals(e.getError().getErrorCode())) {\n        // restart login flow / redirect to authorization endpoint\n    }\n}","preventionTips":["Never expose the redirect URI as a navigable/bookmarkable page","Ensure proxies/LBs preserve query strings","Verify the IdP always redirects back with code+state"],"tags":["oauth2","spring-security","callback","invalid-request"],"backgroundTag":"http-error-response","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}