{"record":{"id":"466a904ab2bed069","repo":"spring-projects/spring-security","slug":"authorization-request-failed-s","errorCode":null,"errorMessage":"Authorization Request failed: %s","messagePattern":"Authorization Request failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilter.java","lineNumber":248,"sourceCode":"\n\tprivate void sendRedirectForAuthorization(HttpServletRequest request, HttpServletResponse response,\n\t\t\tOAuth2AuthorizationRequest authorizationRequest) throws IOException {\n\t\tif (AuthorizationGrantType.AUTHORIZATION_CODE.equals(authorizationRequest.getGrantType())) {\n\t\t\tthis.authorizationRequestRepository.saveAuthorizationRequest(authorizationRequest, request, response);\n\t\t}\n\t\tthis.authorizationRedirectStrategy.sendRedirect(request, response,\n\t\t\t\tauthorizationRequest.getAuthorizationRequestUri());\n\t}\n\n\tprivate void unsuccessfulRedirectForAuthorization(HttpServletRequest request, HttpServletResponse response,\n\t\t\tAuthenticationException ex) throws IOException {\n\t\tThrowable cause = ex.getCause();\n\t\tif (cause != null) {\n\t\t\tLogMessage message = LogMessage.format(\"Authorization Request failed: %s\", cause);\n\t\t\tif (InvalidClientRegistrationIdException.class.isAssignableFrom(cause.getClass())) {\n\t\t\t\t// Log an invalid registrationId at WARN level to allow these errors to be\n\t\t\t\t// tuned separately from other errors\n\t\t\t\tthis.logger.warn(message, ex);\n\t\t\t}\n\t\t\telse {\n\t\t\t\tthis.logger.error(message, ex);\n\t\t\t}\n\t\t}\n\t\tresponse.sendError(HttpStatus.INTERNAL_SERVER_ERROR.value(),\n\t\t\t\tHttpStatus.INTERNAL_SERVER_ERROR.getReasonPhrase());\n\t}\n\n\tprivate static final class DefaultThrowableAnalyzer extends ThrowableAnalyzer {\n\n\t\t@Override\n\t\tprotected void initExtractorMap() {\n\t\t\tsuper.initExtractorMap();\n\t\t\tregisterExtractor(ServletException.class, (throwable) -> {\n\t\t\t\tThrowableAnalyzer.verifyThrowableHierarchy(throwable, ServletException.class);\n\t\t\t\treturn ((ServletException) throwable).getRootCause();\n\t\t\t});","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2AuthorizationRequestRedirectFilter.java#L230-L266","documentation":"OAuth2AuthorizationRequestRedirectFilter.unsuccessfulRedirectForAuthorization handles exceptions thrown while building/redirecting the OAuth2 authorization request. It logs \"Authorization Request failed: <cause>\" at WARN level when the cause is InvalidClientRegistrationIdException (unknown registrationId) and at ERROR level otherwise, then sends an HTTP 500 to the client. The actual failure is in the cause, e.g. the client registration id in the request URL does not match any registered ClientRegistration.","triggerScenarios":"A request to the authorization endpoint (default /oauth2/authorization/{registrationId}) with a registrationId that has no matching ClientRegistration, or an unexpected exception during authorization-request construction/redirect.","commonSituations":"Typo in the registrationId in a login link; client registration beans not loaded (missing issuer URI resolution at startup, network failure fetching OIDC metadata); misconfigured oauth2 client properties; upstream issuer metadata unavailable at request time.","solutions":["Check the logged cause; if InvalidClientRegistrationIdException, fix the registrationId in the link to match a registered client.","Verify spring.security.oauth2.client.registration.* properties (or ClientRegistrationRepository bean) include that registrationId.","If using OIDC discovery, confirm the app can fetch {issuer}/.well-known/openid-configuration at startup.","Handle the exception via failureHandler customization if you want a friendlier redirect than a 500."],"exampleFix":"// before: bad link\n<a href=\"/oauth2/authorization/gogle\">Login</a>\n// after: matches registered client 'google'\n<a href=\"/oauth2/authorization/google\">Login</a>","handlingStrategy":"validation","validationCode":"// verify registrationId resolves before rendering links\nClientRegistration reg = clientRegistrationRepository\n    .findByRegistrationId(\"google\");\nif (reg == null) {\n    throw new IllegalStateException(\"Unknown registrationId: google\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (ClientRegistrationException e) {\n    response.sendRedirect(\"/login?error=registration\"); // custom failure handling\n}","preventionTips":["Generate login links from InMemoryOAuth2AuthorizedClientService/registration ids, not hardcoded strings.","Fail fast at startup if configured client registrations cannot load.","Add a failureHandler on oauth2Login() to return friendly errors instead of 500.","Check oauth2 client properties against the provider's metadata."],"tags":["oauth2","client","authorization-request","config"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}