{"record":{"id":"5b061694cb38d2d3","repo":"apereo/cas","slug":"invalid-oidc-pushed-authorization-request-at","errorCode":null,"errorMessage":"Invalid OIDC pushed authorization request at [{}]","messagePattern":"Invalid OIDC pushed authorization request at \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcHandlerInterceptorAdapter.java","lineNumber":81,"sourceCode":"            request.getRequestURI(), request.getParameterMap().keySet());\n\n        if (casProperties.getAuthn().getOidc().getDiscovery().isRequirePushedAuthorizationRequests()\n            && !HttpMethod.valueOf(request.getMethod()).equals(HttpMethod.POST)\n            && StringUtils.isBlank(request.getParameter(OidcConstants.REQUEST_URI))\n            && isAuthorizationRequest(request, response)) {\n            LOGGER.warn(\"CAS is configured to only accept pushed authorization requests and this is not a POST\");\n            response.setStatus(HttpStatus.SC_FORBIDDEN);\n            return false;\n        }\n\n        if (!isDynamicClientRegistrationEnabled() && (isClientConfigurationRequest(request.getRequestURI()) || isDynamicClientRegistrationRequest(request.getRequestURI()))) {\n            LOGGER.debug(\"Dynamic client registration is disabled. OIDC request at [{}] is rejected.\", request.getRequestURI());\n            response.setStatus(HttpStatus.SC_NOT_IMPLEMENTED);\n            return false;\n        }\n\n        if (isPushedAuthorizationRequest(request.getRequestURI()) && !isValidAuthorizeRequest(new JEEContext(request, response))) {\n            LOGGER.warn(\"Invalid OIDC pushed authorization request at [{}]\", request.getRequestURI());\n            response.setStatus(HttpStatus.SC_FORBIDDEN);\n            writeErrorResponseBody(response);\n            return false;\n        }\n\n        if (isVerifiableCredentialTransactionRequest(request.getRequestURI()) || isPushedAuthorizationRequest(request.getRequestURI())) {\n            LOGGER.trace(\"OIDC request is protected at [{}]\", request.getRequestURI());\n            return requiresAuthenticationAccessTokenInterceptor.getObject().preHandle(request, response, handler);\n        }\n\n        if (isCibaRequest(request.getRequestURI())) {\n            LOGGER.trace(\"OIDC CIBA request is protected at [{}]\", request.getRequestURI());\n            return requiresAuthenticationAccessTokenInterceptor.getObject().preHandle(request, response, handler);\n        }\n\n        if (!super.preHandle(request, response, handler)) {\n            LOGGER.trace(\"Unable to pre-handle OIDC request at [{}]\", request.getRequestURI());\n            return false;","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcHandlerInterceptorAdapter.java#L63-L99","documentation":"CAS received a pushed authorization request (POST to the PAR endpoint) but its contents failed authorization-request validation (isValidAuthorizeRequest). The interceptor responds 403 with an error body. This validates that the pushed parameters constitute a well-formed OAuth2/OIDC authorize request (client_id, response_type, redirect_uri, etc.).","triggerScenarios":"POST to the OIDC PAR endpoint where the payload is missing required authorize parameters (client_id, response_type, redirect_uri), has invalid values, or otherwise fails OAuth20Validator-based authorize validation.","commonSituations":"Clients POSTing incomplete parameter sets; redirect_uri not exactly matching a registered service; response_type not 'code'; client not registered or disabled; missing 'openid' scope handling quirks; parameter encoding bugs in RP libraries.","solutions":["Inspect the CAS debug logs and ensure the POSTed parameters form a complete valid authorize request (client_id, response_type=code, scope containing openid, redirect_uri matching a registered service exactly)","Verify the client_id corresponds to an enabled OIDC-registered service in CAS","Fix the RP client to send all required parameters in the PAR POST","Test with a minimal curl POST replicating the exact parameters to isolate the invalid field"],"exampleFix":"// before\nPOST /oidc/pushAuthRequest  body: client_id=client&response_type=code   (missing redirect_uri/scope)\n// after\nPOST /oidc/pushAuthRequest  body: client_id=client&response_type=code&scope=openid&redirect_uri=https://rp.example.org/cb","handlingStrategy":"validation","validationCode":"const required = ['response_type','client_id','redirect_uri','scope'];\nconst missing = required.filter(p => !parBody.has(p));\nif (missing.length) throw new Error(`PAR payload missing: ${missing.join(',')}`);\nif (!parBody.get('scope').split(' ').includes('openid')) throw new Error('openid scope required');","typeGuard":"function isValidParPayload(body) {\n  return body.has('response_type') && body.has('client_id') &&\n         body.has('redirect_uri') && body.has('scope');\n}","tryCatchPattern":null,"preventionTips":["Validate authorize parameters client-side before POSTing to the PAR endpoint","Ensure redirect_uri exactly matches the registered service","Use response_type=code for CAS OIDC","Enable CAS debug logging to see which validation failed"],"tags":["oidc","par","validation","http-403"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}