{"record":{"id":"4a38fbba7708b707","repo":"apereo/cas","slug":"invalid-request-4a38fb","errorCode":"invalid_request","errorMessage":"CAS cannot accept the request given the issuer is invalid.","messagePattern":"CAS cannot accept the request given the issuer is invalid\\.","errorType":"console","errorClass":null,"httpStatus":400,"severity":"error","filePath":"support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialNonceEndpointController.java","lineNumber":60,"sourceCode":"\n    /**\n     * Handle response entity.\n     *\n     * @param httpRequest  the http request\n     * @param httpResponse the http response\n     * @return the response entity\n     */\n    @PostMapping(value = {\n        '/' + OidcConstants.BASE_OIDC_URL + '/' + OidcConstants.VC_NONCE_URL,\n        \"/**/\" + OidcConstants.VC_NONCE_URL\n    }, consumes = MediaType.APPLICATION_JSON_VALUE)\n    public ResponseEntity handle(\n        final HttpServletRequest httpRequest,\n        final HttpServletResponse httpResponse) {\n\n        val webContext = new JEEContext(httpRequest, httpResponse);\n        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.VC_NONCE_URL))) {\n            LOGGER.warn(\"CAS cannot accept the request given the issuer is invalid.\");\n            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, \"Invalid issuer\");\n            return ResponseEntity.badRequest().body(body);\n        }\n        val nonce = credentialNonceService.create();\n        return ResponseEntity\n            .ok()\n            .body(Map.of(OidcConstants.C_NONCE, nonce.value(), OidcConstants.C_NONCE_EXPIRES_IN, nonce.expiresIn()));\n    }\n\n    /**\n     * Handle errors.\n     *\n     * @param ex the ex\n     * @return the response entity\n     */\n    @ExceptionHandler(Exception.class)\n    @SuppressWarnings(\"UnusedMethod\")\n    private static ResponseEntity<String> handle(final Exception ex) {","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-vc/src/main/java/org/apereo/cas/oidc/vc/issuer/web/OidcVerifiableCredentialNonceEndpointController.java#L42-L78","documentation":"OidcVerifiableCredentialNonceEndpointController.handle issues a credential nonce (c_nonce) for verifiable credential issuance, but first validates the request issuer. If issuerService.validateIssuer fails for the VC nonce URL, the controller responds HTTP 400 'invalid_request' / 'Invalid issuer' instead of a nonce.","triggerScenarios":"POST/GET to the VC nonce endpoint (VC_NONCE_URL) from a host/origin that does not match the configured OIDC issuer.","commonSituations":"Wallet callbacks hitting an internal hostname; misconfigured issuer path; load balancer terminating TLS and changing the scheme seen by CAS.","solutions":["Call the nonce endpoint on the URL matching cas.authn.oidc.issuer exactly.","Enable proper forwarded-header handling so validateIssuer sees the original scheme/host.","Verify the issuer configuration includes the path prefix used by the deployment."],"exampleFix":"// before\ncurl -X POST http://localhost:8443/cas/oidc/vc/nonce\n// after\ncurl -X POST https://sso.example.org/cas/oidc/vc/nonce","handlingStrategy":"validation","validationCode":"String nonceUrl = issuer + \"/vc/nonce\"; // derive from issuer\nif (!URI.create(nonceUrl).getHost().equals(URI.create(issuer).getHost())) {\n    throw new IllegalArgumentException(\"Nonce endpoint must be on the issuer host\");\n}","typeGuard":null,"tryCatchPattern":"if (resp.status() == 400 && body.contains(\"Invalid issuer\")) {\n    throw new IllegalStateException(\"Call the nonce endpoint via the configured issuer URL\");\n}","preventionTips":["Construct wallet callback URLs from the issuer, not from internal hostnames","Keep scheme consistent (https) end to end","Test nonce issuance through the same ingress path production clients use"],"tags":["oidc","verifiable-credentials","issuer","nonce"],"backgroundTag":"invalid-url","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}