{"record":{"id":"361fc20027e90bee","repo":"apereo/cas","slug":"cas-is-configured-to-only-accept-pushed-authorizat-361fc2","errorCode":null,"errorMessage":"CAS is configured to only accept pushed authorization requests","messagePattern":"CAS is configured to only accept pushed authorization requests","errorType":"console","errorClass":null,"httpStatus":403,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/authorize/OidcAuthorizeEndpointController.java","lineNumber":51,"sourceCode":"    }\n\n    @GetMapping({\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OAuth20Constants.AUTHORIZE_URL,\n        \"/**/\" + OidcConstants.AUTHORIZE_URL\n    })\n    @Operation(summary = \"Handle OIDC authorization request\")\n    @Override\n    public ModelAndView handleRequest(final HttpServletRequest request, final HttpServletResponse response) throws Throwable {\n        val webContext = new JEEContext(request, response);\n        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.AUTHORIZE_URL, OAuth20Constants.AUTHORIZE_URL))) {\n            LOGGER.warn(\"CAS cannot accept the authorization request given the issuer is invalid.\");\n            return OAuth20Utils.writeError(response, OAuth20Constants.INVALID_REQUEST, \"Invalid issuer\");\n        }\n\n        if (getConfigurationContext().getDiscoverySettings().isRequirePushedAuthorizationRequests()\n            && webContext.getRequestURL().endsWith(OidcConstants.AUTHORIZE_URL)\n            && StringUtils.isBlank(request.getParameter(OidcConstants.REQUEST_URI))) {\n            LOGGER.warn(\"CAS is configured to only accept pushed authorization requests\");\n            return OAuth20Utils.produceUnauthorizedErrorView(HttpStatus.FORBIDDEN);\n        }\n\n        val scopes = getConfigurationContext().getRequestParameterResolver().resolveRequestedScopes(webContext);\n        if (scopes.isEmpty() || !scopes.contains(OidcConstants.StandardScopes.OPENID.getScope())) {\n            LOGGER.warn(\"Provided scopes [{}] are undefined by OpenID Connect, which requires that scope [{}] MUST be specified, \"\n                        + \"or the behavior is unspecified. CAS MAY allow this request to be processed for now.\",\n                scopes, OidcConstants.StandardScopes.OPENID.getScope());\n        }\n        return super.handleRequest(request, response);\n    }\n\n    @PostMapping({\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OAuth20Constants.AUTHORIZE_URL,\n        \"/**/\" + OidcConstants.AUTHORIZE_URL\n    })\n    @Override\n    @Operation(summary = \"Handle OIDC authorization request\")","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/authorize/OidcAuthorizeEndpointController.java#L33-L69","documentation":"When requirePushedAuthorizationRequests is enabled, the authorize endpoint only accepts requests that supply a request_uri (produced by a prior PAR call). A direct authorize request without request_uri is rejected with HTTP 403 and an error view.","triggerScenarios":"A browser navigation (GET) to /oidc/authorize whose URL ends with 'authorize' and whose parameter map lacks a non-blank request_uri, while requirePushedAuthorizationRequests=true.","commonSituations":"Same misconfiguration as error 530: PAR enforcement turned on but clients still doing classic front-channel redirects; forgot that even POST-based authorize without request_uri is rejected; discovery metadata not consumed by the RP.","solutions":["Have clients obtain a request_uri via the PAR endpoint and pass it on /authorize","Disable the mode: cas.authn.oidc.discovery.require-pushed-authorization-requests=false","Ensure the PAR request_uri is not blank/truncated when forwarded","Adopt an RP library that advertises and honors 'require_pushed_authorization_requests' in discovery metadata"],"exampleFix":"// before\nGET /oidc/authorize?response_type=code&client_id=client&scope=openid&redirect_uri=...\n// after\nPOST /oidc/pushAuthRequest?... -> request_uri\nGET /oidc/authorize?client_id=client&request_uri=urn:ietf:params:oauth:request_uri:xyz","handlingStrategy":"validation","validationCode":"if (requirePar && !params.get('request_uri')) {\n  throw new Error('PAR enabled: call the pushed authorization endpoint first and pass request_uri');\n}","typeGuard":"function isParAuthorizeUrl(url, requirePar) {\n  return !requirePar || new URL(url).searchParams.has('request_uri');\n}","tryCatchPattern":null,"preventionTips":["Enable PAR in the RP client library when the CAS flag is on","Do the PAR POST and cache the returned request_uri","Disable the flag if legacy GET-based authorize must keep working","Verify discovery metadata flags consumed by the RP"],"tags":["oidc","par","http-403","authorization-request"],"backgroundTag":"oauth-request-rejected","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}