{"record":{"id":"302d30fee06c45ec","repo":"spring-projects/spring-security","slug":"invalid-client-metadata-302d30","errorCode":"invalid_client_metadata","errorMessage":"Invalid Client Registration: jwks_uri","messagePattern":"Invalid Client Registration: jwks_uri","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationValidator.java","lineNumber":267,"sourceCode":"\t\t\tcatch (URISyntaxException ex) {\n\t\t\t\tthrow createException(errorCode, fieldName);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate static void validateJwkSetUri(OidcClientRegistrationAuthenticationContext authenticationContext) {\n\t\tOidcClientRegistrationAuthenticationToken clientRegistrationAuthentication = authenticationContext\n\t\t\t.getAuthentication();\n\t\tAssert.notNull(clientRegistrationAuthentication.getClientRegistration(), \"clientRegistration cannot be null\");\n\t\tURL jwkSetUrl = clientRegistrationAuthentication.getClientRegistration().getJwkSetUrl();\n\t\tif (jwkSetUrl == null) {\n\t\t\treturn;\n\t\t}\n\t\tif (!\"https\".equalsIgnoreCase(jwkSetUrl.getProtocol())) {\n\t\t\tif (LOGGER.isDebugEnabled()) {\n\t\t\t\tLOGGER.debug(LogMessage.format(\"Invalid request: jwks_uri does not use https ('%s')\", jwkSetUrl));\n\t\t\t}\n\t\t\tthrow createException(\"invalid_client_metadata\", OidcClientMetadataClaimNames.JWKS_URI);\n\t\t}\n\t}\n\n\tprivate static void validateJwkSetUriSimple(OidcClientRegistrationAuthenticationContext authenticationContext) {\n\t\t// No validation. Preserves prior behavior.\n\t}\n\n\tprivate static void validateScope(OidcClientRegistrationAuthenticationContext authenticationContext) {\n\t\tOidcClientRegistrationAuthenticationToken clientRegistrationAuthentication = authenticationContext\n\t\t\t.getAuthentication();\n\t\tAssert.notNull(clientRegistrationAuthentication.getClientRegistration(), \"clientRegistration cannot be null\");\n\t\tList<String> scopes = clientRegistrationAuthentication.getClientRegistration().getScopes();\n\t\tif (!CollectionUtils.isEmpty(scopes)) {\n\t\t\tif (LOGGER.isDebugEnabled()) {\n\t\t\t\tLOGGER.debug(LogMessage.format(\n\t\t\t\t\t\t\"Invalid request: scope must not be set during Dynamic Client Registration ('%s')\", scopes));\n\t\t\t}\n\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_SCOPE, OidcClientMetadataClaimNames.SCOPE);","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationValidator.java#L249-L285","documentation":"During strict OIDC Dynamic Client Registration, the jwks_uri client metadata field must use the https protocol. If a jwks_uri is provided with a non-https scheme (e.g. http://), validateJwkSetUri throws invalid_client_metadata naming jwks_uri.","triggerScenarios":"Registering/updating a client via the OIDC client registration endpoint with metadata containing a jwks_uri whose URL protocol is not https while a JWK Set URI is present.","commonSituations":"Pointing jwks_uri at a local http key server in dev; internal key endpoints exposed over plain http; copying an http URL from legacy infrastructure.","solutions":["Serve the client's JWK Set over https and register that https URL as jwks_uri","If the client has no remote JWK Set, omit jwks_uri and supply jwks (inline key set) instead if supported","Check debug logs for the logged offending jwks_uri value"],"exampleFix":"// before\n{\"jwks_uri\": \"http://keys.client.example.com/jwks\"}\n// after\n{\"jwks_uri\": \"https://keys.client.example.com/jwks\"}","handlingStrategy":"validation","validationCode":"if (jwksUri != null && !jwksUri.toLowerCase().startsWith(\"https://\")) {\n    throw new IllegalArgumentException(\"jwks_uri must be https: \" + jwksUri);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Serve JWK Sets over https only","Omit jwks_uri entirely when the client has no remote key set","Check scheme case-insensitively when building client metadata programmatically"],"tags":["oauth2","oidc","client-registration","jwks"],"backgroundTag":"invalid-url","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}