{"record":{"id":"3e0dd4ae9ac51102","repo":"passbolt/passbolt_api","slug":"invalid-response-invalid-jwks-uri","errorCode":null,"errorMessage":"Invalid response. Invalid JWKS URI","messagePattern":"Invalid response\\. Invalid JWKS URI","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php","lineNumber":184,"sourceCode":"            if (is_string($response)) {\n                // Cap excerpt to limit log volume on large/HTML responses; mb_strcut is UTF-8-safe.\n                $excerpt = mb_strcut($response, 0, 200, 'UTF-8');\n                // Escape newlines and control characters via JSON encoding so they don't corrupt log output.\n                $msg .= ' ' . sprintf('Response text (truncated): %s', json_encode($excerpt));\n            }\n            throw new InternalErrorException($msg);\n        }\n        if (!isset($response['jwks_uri'])) {\n            throw new InternalErrorException('Invalid response. Missing JWKS URI');\n        }\n        if (!isset($response['authorization_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Missing authorization endpoint.');\n        }\n        if (!isset($response['token_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Missing token endpoint.');\n        }\n        if (!Validation::url($response['jwks_uri'])) {\n            throw new InternalErrorException('Invalid response. Invalid JWKS URI');\n        }\n        if (!Validation::url($response['authorization_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Invalid authorization endpoint.');\n        }\n        if (!Validation::url($response['token_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Invalid token endpoint.');\n        }\n    }\n\n    /**\n     * @inheritDoc\n     */\n    protected function getAuthorizationParameters(array $options)\n    {\n        $options = parent::getAuthorizationParameters($options);\n\n        /**\n         * The \"approval_prompt\" MUST be removed as it is not supported by Google, use \"prompt\" instead:","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php#L166-L202","documentation":"Beyond presence, validateOpenIdConfiguration() validates each endpoint URL with CakePHP's Validation::url(). A jwks_uri that fails URL validation is unusable for fetching signing keys, so an InternalErrorException 'Invalid response. Invalid JWKS URI' is thrown.","triggerScenarios":"Decoded discovery JSON has jwks_uri set but its value fails Validation::url() (e.g. relative path, missing scheme, garbage value).","commonSituations":"IdP emitting relative URIs instead of absolute URLs; corrupted/proxied metadata injecting a path-only jwks_uri; typo in IdP configuration producing malformed URLs.","solutions":["Curl the discovery URL and inspect the jwks_uri value; it must be an absolute http(s) URL.","Fix the IdP configuration so it publishes absolute URLs.","Check any reverse proxy/rewrite layer modifying the discovery body.","If the IdP cannot be fixed, switch to an IdP instance emitting compliant absolute URLs."],"exampleFix":"// before\n'{\"jwks_uri\":\"/jwks\"}'\n// after\n'{\"jwks_uri\":\"https://auth.example.com/jwks\"}'","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\n$doc = json_decode(file_get_contents($wellKnownUrl), true);\nif (!isset($doc['jwks_uri']) || !Validation::url($doc['jwks_uri'])) { throw new UnexpectedValueException('jwks_uri missing or not a valid absolute URL.'); }","typeGuard":"function isValidJwksUri(mixed $doc): bool { return is_array($doc) && isset($doc['jwks_uri']) && is_string($doc['jwks_uri']) && Validation::url($doc['jwks_uri']); }","tryCatchPattern":"try { $keys = $provider->getJwtVerificationKeys(); } catch (InternalErrorException $e) { if ($e->getMessage() === 'Invalid response. Invalid JWKS URI') { /* metadata emits a malformed jwks_uri */ } throw $e; }","preventionTips":["Require absolute http(s) URLs in IdP metadata; reject relative URIs","Verify published metadata after any IdP base-URL change","Watch for proxies rewriting URLs in the discovery body","Add URL validation of all OIDC endpoints in your deployment checks"],"tags":["openid-configuration","url-validation","jwks","response-validation"],"backgroundTag":"invalid-url-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}