{"record":{"id":"3920abb79d9f4a25","repo":"spring-projects/spring-security","slug":"invalid-user-info-response-3920ab","errorCode":"invalid_user_info_response","errorMessage":"An error occurred while attempting to retrieve the UserInfo Resource: ${errorDetails}","messagePattern":"An error occurred while attempting to retrieve the UserInfo Resource: (.+?)","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java","lineNumber":150,"sourceCode":"\tprivate ResponseEntity<Map<String, Object>> getResponse(OAuth2UserRequest userRequest, RequestEntity<?> request) {\n\t\ttry {\n\t\t\treturn this.restOperations.exchange(request, PARAMETERIZED_RESPONSE_TYPE);\n\t\t}\n\t\tcatch (OAuth2AuthorizationException ex) {\n\t\t\tOAuth2Error oauth2Error = ex.getError();\n\t\t\tStringBuilder errorDetails = new StringBuilder();\n\t\t\terrorDetails.append(\"Error details: [\");\n\t\t\terrorDetails.append(\"UserInfo Uri: \")\n\t\t\t\t.append(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri());\n\t\t\terrorDetails.append(\", Error Code: \").append(oauth2Error.getErrorCode());\n\t\t\tif (oauth2Error.getDescription() != null) {\n\t\t\t\terrorDetails.append(\", Error Description: \").append(oauth2Error.getDescription());\n\t\t\t}\n\t\t\terrorDetails.append(\"]\");\n\t\t\toauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,\n\t\t\t\t\t\"An error occurred while attempting to retrieve the UserInfo Resource: \" + errorDetails.toString(),\n\t\t\t\t\tnull);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);\n\t\t}\n\t\tcatch (UnknownContentTypeException ex) {\n\t\t\tString errorMessage = \"An error occurred while attempting to retrieve the UserInfo Resource from '\"\n\t\t\t\t\t+ userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri()\n\t\t\t\t\t+ \"': response contains invalid content type '\" + ex.getContentType().toString() + \"'. \"\n\t\t\t\t\t+ \"The UserInfo Response should return a JSON object (content type 'application/json') \"\n\t\t\t\t\t+ \"that contains a collection of name and value pairs of the claims about the authenticated End-User. \"\n\t\t\t\t\t+ \"Please ensure the UserInfo Uri in UserInfoEndpoint for Client Registration '\"\n\t\t\t\t\t+ userRequest.getClientRegistration().getRegistrationId() + \"' conforms to the UserInfo Endpoint, \"\n\t\t\t\t\t+ \"as defined in OpenID Connect 1.0: 'https://openid.net/specs/openid-connect-core-1_0.html#UserInfo'\";\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE, errorMessage, null);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);\n\t\t}\n\t\tcatch (RestClientException ex) {\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,\n\t\t\t\t\t\"An error occurred while attempting to retrieve the UserInfo Resource: \" + ex.getMessage(), null);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);\n\t\t}","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java#L132-L168","documentation":"DefaultOAuth2UserService.getResponse wraps any exception that occurred while calling the UserInfo endpoint (HTTP errors, OAuth2Error responses with errorDetails, I/O failures) into an OAuth2AuthenticationException with error code 'invalid_user_info_response'. The library throws it because the UserInfo Resource could not be retrieved successfully, so the authenticated user's claims are unavailable. The appended errorDetails describe the underlying cause (status code, error code, description).","triggerScenarios":"Any exception (other than UnknownContentTypeException, which has its own catch) raised while executing the RestOperations call to the UserInfo endpoint in DefaultOAuth2UserService.getResponse — e.g. non-2xx status with an OAuth2 error body, connection failure, or read timeout during loadUser(userRequest).","commonSituations":"Provider returns 401/403 because the access token is expired or revoked; UserInfo endpoint is temporarily down or DNS fails; provider returns an OAuth2 error JSON (e.g. invalid_token) in the UserInfo response; corporate proxy blocks the outbound call.","solutions":["Read the OAuth2AuthenticationException's OAuth2Error description and underlying cause (getCause) to identify the concrete failure (status, provider error code, IO error).","If the cause is 401 invalid_token, force a refresh of the access token (OAuth2AuthorizedClientManager/refresh flow) and retry.","Verify the configured user-info-uri is reachable and returns application/json with the user's claims (curl -H 'Authorization: Bearer <token>' <userInfoUri>).","Check network/proxy/TLS settings and provider outage status; configure timeouts and retries on the RestOperations used by DefaultOAuth2UserService."],"exampleFix":"// before\nDefaultOAuth2UserService userService = new DefaultOAuth2UserService();\nOAuth2User user = userService.loadUser(userRequest); // throws raw OAuth2AuthenticationException\n\n// after\nDefaultOAuth2UserService userService = new DefaultOAuth2UserService();\nOAuth2User user;\ntry {\n    user = userService.loadUser(userRequest);\n}\ncatch (OAuth2AuthenticationException ex) {\n    logger.warn(\"UserInfo retrieval failed: {} cause={}\", ex.getError().getDescription(), ex.getCause());\n    throw new AuthenticationServiceException(\"Upstream UserInfo failed, see logs\", ex);\n}","handlingStrategy":"try-catch","validationCode":"boolean tokenPresent = authorizedClient.getAccessToken() != null\n    && authorizedClient.getAccessToken().getTokenValue() != null\n    && !authorizedClient.getAccessToken().getTokenValue().isBlank();","typeGuard":null,"tryCatchPattern":"try {\n    OAuth2User user = defaultOAuth2UserService.loadUser(userRequest);\n} catch (OAuth2AuthenticationException ex) {\n    if (ex.getCause() instanceof ResourceAccessException) {\n        // network-level failure: retry or return 503\n    } else {\n        // token/provider issue: trigger re-authentication\n    }\n}","preventionTips":["Refresh expired access tokens before calling loadUser","Set sane connect/read timeouts on the RestOperations used for UserInfo","Monitor provider health and log ex.getError().getDescription() with the cause","Use issuer-uri discovery so the correct userinfo endpoint is used"],"tags":["oauth2","oidc","userinfo","network","spring-security"],"backgroundTag":"upstream-api-error","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}