{"record":{"id":"5d87e06369c33d01","repo":"spring-projects/spring-security","slug":"invalid-client-registration-fieldname","errorCode":null,"errorMessage":"Invalid Client Registration: + fieldName","messagePattern":"Invalid Client Registration: \\+ fieldName","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientRegistrationAuthenticationValidator.java","lineNumber":240,"sourceCode":"\t\t\t\tLOGGER.debug(LogMessage.format(\n\t\t\t\t\t\t\"Invalid request: scope must not be set during Dynamic Client Registration ('%s')\", scopes));\n\t\t\t}\n\t\t\tthrow createException(OAuth2ErrorCodes.INVALID_SCOPE, OAuth2ClientMetadataClaimNames.SCOPE);\n\t\t}\n\t}\n\n\tprivate static void validateScopeSimple(OAuth2ClientRegistrationAuthenticationContext authenticationContext) {\n\t\t// No validation. Preserves prior behavior.\n\t}\n\n\tprivate static boolean isUnsafeScheme(String scheme) {\n\t\treturn \"javascript\".equalsIgnoreCase(scheme) || \"data\".equalsIgnoreCase(scheme)\n\t\t\t\t|| \"vbscript\".equalsIgnoreCase(scheme);\n\t}\n\n\tprivate static OAuth2AuthenticationException createException(String errorCode, String fieldName) {\n\t\tOAuth2Error error = new OAuth2Error(errorCode, \"Invalid Client Registration: \" + fieldName, ERROR_URI);\n\t\tthrow new OAuth2AuthenticationException(error);\n\t}\n\n}\n","sourceCodeStart":222,"sourceCodeEnd":244,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2ClientRegistrationAuthenticationValidator.java#L222-L244","documentation":"OAuth2ClientRegistrationAuthenticationValidator throws this when a client registration parameter in an OAuth2ClientRegistrationAuthenticationToken fails validation, e.g. redirect URIs using forbidden schemes (javascript:, data:, vbscript:), an invalid jwkSetUri, or an invalid requested scope. The message is 'Invalid Client Registration: <fieldName>' where fieldName identifies the offending registration property.","triggerScenarios":"Dynamic client registration (RFC 7591) request containing: a redirect_uri whose scheme is javascript/data/vbscript (validateRedirectUris / validateRedirectUrisSimple), a jwkSetUri that is not a valid absolute HTTPS URL (validateJwkSetUri), or a scope string that fails the RegisteredClient scope validation (validateScope).","commonSituations":"Dev/test clients registering 'http://localhost' or browser-friendly redirect URIs like 'javascript:...' for SPA flows; typos in jwkSetUri (missing https, relative URL); scope names containing illegal characters or exceeding size limits during automated client provisioning.","solutions":["Fix the redirect_uri values: use standard schemes (https, or http://127.0.0.1 loopback, or custom app scheme) and remove javascript:/data:/vbscript: URIs.","Correct the jwk_set_uri to an absolute https:// URL pointing to the client's JWKS endpoint.","Fix the requested scope: use only allowed characters (per RegisteredClient.withScopes / Scope validation) and no leading/trailing whitespace.","Catch OAuth2AuthenticationException in the registration endpoint and return the OAuth2Error details to the registering client."],"exampleFix":"// before\nMap<String, Object> meta = Map.of(\"redirect_uris\", List.of(\"javascript:void(0)\"));\n// after\nMap<String, Object> meta = Map.of(\"redirect_uris\", List.of(\"https://client.example.com/callback\"));","handlingStrategy":"validation","validationCode":"for (String uri : redirectUris) {\n    URI u = URI.create(uri);\n    String scheme = u.getScheme();\n    if (scheme == null || scheme.equalsIgnoreCase(\"javascript\")\n            || scheme.equalsIgnoreCase(\"data\") || scheme.equalsIgnoreCase(\"vbscript\")) {\n        throw new IllegalArgumentException(\"Forbidden redirect URI scheme: \" + uri);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    clientRegistrationService.save(registeredClient);\n} catch (OAuth2AuthenticationException e) {\n    log.error(\"Client registration rejected: {}\", e.getError().getDescription());\n    return ResponseEntity.badRequest().body(e.getError());\n}","preventionTips":["Validate redirect URIs against an allowlist of schemes before submitting registration requests.","Keep jwkSetUri as an absolute https:// URL and validate it with URI.create(...).isAbsolute().","Test dynamic client registration payloads against the validator in CI."],"tags":["oauth2","client-registration","validation","security"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}